Missing authentication in beycanpress Cryptocurrency , Launchpad , ICO & IDO, Airdrop by…
Priority LOW 30CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.7. This makes it possible for unauthenticated attackers to manipulate presales counters.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| beycanpress | Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO | up to 2.4.7 | — | No fix listed | CNA |
- Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO Vendorbeycanpress Affected up to 2.4.7 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11771
- 2026-10-03 Alias added: GHSA-f449-j4r9-r99x
References
Other 3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c5793f-4d98-4ec1-a9b6-6e7c3f8b6099?source=cve
- https://plugins.trac.wordpress.org/browser/tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop/tags/2.4.6/app/RestAPI.php#L275
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3449189%40tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop&new=3449189%40tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop&sfp_email=&sfph_mail=
More beycanpress vulnerabilities
- TI-2026-05664 Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation CVSS 3.1HIGH 8.8
- TI-2025-10901 Crypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment Bypass CVSS 3.1HIGH 7.5
- TI-2025-10793 Missing authorization in beycanpress Cryptocurrency , Launchpad , ICO & IDO, Airdrop by… CVSS 3.1MEDIUM 4.3
Sources
- CVE-2025-11771 · CVE Program
- CVE-2025-11771 · NVD
- FIRST EPSS
- GHSA-f449-j4r9-r99x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences