cleantalk
Vulnerabilities and Security Researches

Vchasno Kasa, CVE-2025-6720

CVE, Research URL

CVE-2025-6720

Home page URL

Security reports for Vchasno Kasa

Application

Vchasno Kasa

Published on
Jul 19, 2025
Research Description
The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_all_log() function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to clear log files.
Affected versions
Min -, max 1.0.4.
Status
vulnerable
Previous vulnerability researches
Ultimate Push Notifications ( Mobile / Desktop ), Receive Notification From WooCommerce, BuddyPress, WordPress Default Events & (CVE-2025-50028) , Jul 19, 2025
Ultimate Push Notifications ( Mobile / Desktop ), Receive Notification From WooCommerce, BuddyPress, WordPress Default Events & (CVE-2025-31561) , Apr 03, 2025
Ultimate Push Notifications ( Mobile / Desktop ), Receive Notification From WooCommerce, BuddyPress, WordPress Default Events & (CVE-2025-31548) , Apr 03, 2025
New vulnerability
DB Backup (CVE-2025-50031) , Jul 19, 2025
Vchasno Kasa (CVE-2025-6720) , Jul 19, 2025
Vchasno Kasa (CVE-2025-6721) , Jul 19, 2025
Media Library Assistant (CVE-2025-7035) , Jul 19, 2025
Wallet System for WooCommerce – Digital Wallet, Cashback Rewards, Recharge User Wallets, View Transaction History (CVE-2025-54041) , Jul 19, 2025