CVE-2025-11771 is a vulnerability in the beycanpress Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO WordPress plugin. The vulnerability arises from missing authentication and capability checks on the 'createSaleRecord' function, enabling unauthenticated attackers to manipulate presale counters. This affects all versions up to 2.4.7. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no evidence of known exploits in the wild or an official patch at this time.

The vulnerability allows unauthenticated attackers to modify presale counters, potentially disrupting the integrity of presale data within the affected plugin. There is no indication of confidentiality or availability impact. The manipulation of presale counters could affect business logic or financial tracking related to token sales.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is indicated, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the plugin's functionality or disabling it if feasible to prevent exploitation.