Back to Database
Status published
Medium
CVE-2025-6720
Vchasno Kasa <= 1.0.3 - Unauthenticated Log File Clearing
Vulnerability Description
The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_all_log() function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to clear log files.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6720
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Phong Nguyen
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cd03483a-f46c-4e17-8b58-df87b0ad7fa3?source=cve
- https://plugins.trac.wordpress.org/browser/mrkv-vchasno-kasa/trunk/classes/mrkv-setup.php#L245
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3328827%40mrkv-vchasno-kasa&new=3328827%40mrkv-vchasno-kasa&sfp_email=&sfph_mail=
More from bandido
View All →CVE-2025-6721
Vchasno Kasa <= 1.0.3 - Missing Authorization to Unauthenticated Invoice Generation
Medium
5.3
CVE-2025-12170
Checkbox <= 2.8.10 - Missing Authorization to Unauthenticated Log Clearing
Medium
5.3
CVE-2024-12049
Woo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters
Medium
6.1
Affected Vendor
bandido
View all reports →Affected Software
MORKVA Vchasno Kasa Integration
Vulnerable Versions:
0
Timeline
Official Publish:
July 19th, 2025
Last Modified:
April 8th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N