CVE-2025-1440

Advanced iFrame <= 2024.5 - Unauthenticated Settings Update

2025-03-25 00:00

Strategic Overview

Status: Patched in 2025.0
Affected Plugin: Advanced iFrame
Affected Version: <= 2024.5
CVSS: 5.3Medium
Weakness type: CWE-20 · Improper Input Validation
CVE: CVE-2025-1440

View all Advanced iFrame vulnerabilities

At a glance

CVE-2025-1440 is a medium-severity Improper Input Validation vulnerability in the Advanced iFrame WordPress plugin, affecting versions <= 2024.5. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 2025.0; sites on affected versions should update now. Disclosed March 2025, reported by Peter Thaleikis.

Vulnerability Overview

The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions. This makes it possible for unauthenticated attackers to update the advancediFrameParameterData option with an excessive amount of unvalidated data.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-20: Improper Input Validation

Advanced iFrame <= 2024.5 carries this weakness at aip_map_url_callback(), and reaching it takes no account at all. Improper input validation means the application accepts input without confirming it has the form, type or range the code downstream assumes.

The concrete impact depends on where the unvalidated value lands, which is why records in this class range from cosmetic bugs to full compromise. For Advanced iFrame the fix is 2025.0: builds <= 2024.5 are affected, anything from 2025.0 onward is not.

Remediation

Update to version 2025.0, or a newer patched version

How does WordSec protect against this?

Requests carrying this pattern arrive without a session, so nothing upstream of the firewall gets a chance to reject them: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Advanced iFrame 2025.0 closes this, and updating the plugin is the step that ends it.

Firewall
Login Security
Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2025-1440 https://www.wordfence.com/threat-intel/vulnerabilities/id/b92913fa-aa1e-40a0-9a48-d730b2102217 https://nvd.nist.gov/vuln/detail/CVE-2025-1440

Related records

Other vulnerabilities in Advanced iFrame

CVSS Vector

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Base

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityLow
AvailabilityNone

This record contains material that is subject to copyright

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/