CVE-2025-6720 MEDIUM

CVE-2025-6720: Vchasno Kasa <= 1.0.3 - Unauthenticated Log File Clearing

Vendor Bandido
Product MORKVA Vchasno Kasa Integration
Weakness CWE-862 · Missing authorization
Published July 19, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_all_log() function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to clear log files.

Explanation of Vulnerability in Simple Terms

02Summary

The MORKVA Vchasno Kasa Integration plugin through version 1.0.3 lacks proper authorization checks on certain functions. An unauthenticated attacker can modify data on the site without permission. The vulnerability requires no user interaction and is remotely exploitable over the network.

What an attacker can do

03Attacker Capabilities

Modify site data without authentication or authorization.

Potential impact on your site

04Site Impact

Unauthorized changes to site content or configuration via the Kasa integration.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 19, 2025 CVE published
April 8, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2023-27454 WordPress Rife Elementor Extensions & Templates plugin <= 1.1.10 - Broken Access Control vulnerability CVE-2024-34690 Missing Authorization check in SAP Student Life Cycle Management (SLcM) CVE-2025-22671 WordPress Disable Elementor Editor Translation plugin <= 1.0.2 - Broken Access Control vulnerability CVE-2026-39643 WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerability CVE-2024-13370 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license)