GCVE - cpe:2.3:a:virusdie:virusdie_–_one-click_website

Approved changes feed: RSS · Atom

cpe:2.3:a:virusdie:virusdie_–_one-click_website_security:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Virusdie (`f19f8ad6-88aa-5c20-a7a4-d35a6fc67d6e`)
Product	Virusdie – One Click Website Security (`434d3467-d65f-5183-86df-56a08e0921a6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-14864`	vulnerable	2026-06-08 07:06:35.263184	Virusdie <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key Disclosure MEDIUM (4.3) The Virusdie - One-click website security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.7. This is due to missing capability checks on the `vd_get_apikey` function which is hooked to `wp_ajax_virusdie_apikey`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve the site's Virusdie API key, which could be used to access the site owner's Virusdie account and potentially compromise site security. Published: 2026-02-19T04:36:18.706Z Updated: 2026-04-08T17:06:29.314Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef2e0b1-52ef-4f70-9e95-d010a586d060?source=cve https://plugins.trac.wordpress.org/browser/virusdie/trunk/inc/class-virusdie.php#L75 https://plugins.trac.wordpress.org/browser/virusdie/trunk/inc/tools/class-virusdie-behavior.php#L240 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3450727%40virusdie&new=3450727%40virusdie&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.