Description
The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siteheart | HyperComments | ≤ 1.2.2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
RandomRobbieBF/CVE-2025-5701 ★ 2 · Jun 12, 2025
HyperComments <= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Update
-
Nxploited/CVE-2025-5701 ★ 1 · Jun 5, 2025
WordPress HyperComments Plugin <= 1.2.2 is vulnerable to Privilege Escalation
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- HyperComments <= 1.2.2 - Arbitrary Options Update http/cves/2025/CVE-2025-5701.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.