CVE Alert: CVE-2025-11504 – quickcreator – Quickcreator – AI Blog Writer

Risk verdict

High risk: unauthenticated access to the plugin’s exposed file enables theft of the API key and destructive site actions.

Why this matters

An exposed API key lets an attacker impersonate the site to create posts and inject XSS payloads, risking defacement, content manipulation, and potential user trust erosion. The combination of unauthenticated access and high-impact data exposure can also aid later-stage exploitation or data leakage if the key grants broader privileges.

Most likely attack path

• Preconditions: WordPress site with the vulnerable Quickcreator plugin (versions 0.0.9–0.1.17) installed and its du pasrala.txt file publicly accessible.
• Exploitation: Attacker reads the file to obtain the API key without authentication, then uses it to perform post creation and inject payloads.
• Potential movement: With content-level access via the API key, attackers can seed new posts or modify pages; limited lateral movement depends on the key’s scope and permissions.

Who is most exposed

Sites running WordPress with this plugin active, especially on publicly accessible hosting or poorly protected file paths, are at higher risk. Shared or misconfigured hosting with exposed plugin directories is a common exposure pattern.

Detection ideas

• Alerts on access to /wp-content/plugins/quickcreator/dupasrala.txt or similar sensitive-file paths.
• Unauthenticated POSTs or rapid mass-post creation from unusual IPs.
• Use of extracted API keys in content management actions.
• Posts containing unexpected or malformed scripts/XSS payloads.
• Sudden changes in content authored by accounts with limited privileges.

Mitigation and prioritisation

• Apply the plugin patch to 0.1.17+ or upgrade to latest release; remove or disable the vulnerable plugin if not required.
• Restrict public access to plugin files (server deny/htaccess) and rotate any API keys exposed by the plugin.
• Implement Web Application Firewall rules to block access to the sensitive file path and to suspicious post activity.
• Monitor for anomalous post creation and content payloads; enforce stricter content validation.
• Plan a change-management window for patch validation and site-wide backups prior to deployment.