Medium severity · published Jun 20, 2025
CVE-2025-49997
WordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF Vulnerability
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.18.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
Giveaways and Contests by RafflePress · Syed Balkhi
through 1.12.18 · source: vendor
Affected product
GA
Giveaways and Contests by RafflePress
Syed Balkhi
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-49997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-49997
patchstack.com
https://patchstack.com/database/Wordpress/Plugin/rafflepress/vulnerability/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-17-broken-access-control-vulnerability?_s_id=cve
More from Giveaways and Contests by RafflePress
4.3
CVE-2025-66064
WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability