Ultimate Auction Vulnerabilities

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 4.3.3

Fixed in:

4.3.4

Disclosed:

Dec 12, 2025

CVE-2025-66125 on NVD →

The Ultimate Auction plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 4.3.2

Fix:

No patched version reported

Disclosed:

Dec 12, 2025

CVE-2025-68084 on NVD →

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as pages and allows them...

CVSS:

5.4

Affected:

up to 4.2.9

Fixed in:

4.3.0

Disclosed:

Mar 3, 2025

CVE-2025-0958 on NVD →

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated...

CVSS:

5.8

Affected:

up to 4.2.7

Fixed in:

4.2.8

Disclosed:

Jul 26, 2024

CVE-2024-6591 on NVD →

The Ultimate Auction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.2.5. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform administrative actions via a forged request granted t...

CVSS:

4.3

Affected:

up to 4.2.5

Fixed in:

4.2.6

Disclosed:

Jul 6, 2024

CVE-2024-37543 on NVD →

The Ultimate Auction plugin for WordPress is vulnerable to Cross-Site Request Forgery and Cross-Site Scripting in versions up to, and including, 4.0.5. This is due to missing or incorrect nonce validation on several functions and missing sanitization and escaping on several parameters. This makes it possible for unauth...

CVSS:

8.8

Affected:

up to 4.0.5

Fixed in:

4.0.6

Disclosed:

Dec 18, 2019

The "Ultimate WordPress Auction Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions before 1.0.1. This is due to missing or incorrect nonce validation on the ua_wdm_add_auc function. This makes it possible for unauthenticated attackers to add fake auction bids via a forged request grant...

CVSS:

8.8

Affected:

up to 1.0.1

Fixed in:

1.0.1

Disclosed:

Jun 17, 2013