Rnags vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Rnags products: 2 record(s), with severity, exploitation and fixes.

Reuters Direct 2

Exploited only (KEV) →

CVE-2025-12579 Medium · 5.3 CWE-862 Nov 27, 2025

Reuters Direct <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset

The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to reset the plugin's settings.

CVE-2025-12578 Medium · 4.3 CWE-352 Nov 27, 2025

Reuters Direct <= 3.0.0 - Cross-Site Request Forgery to Settings Reset

The Reuters Direct plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the the 'class-reuters-direct-settings.php' page. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.