CVE-2025-11773 is a missing authorization vulnerability (CWE-862) in the beycanpress Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO WordPress plugin. The vulnerability exists because the 'saveDeployedContract' function does not perform proper capability checks before allowing modification of the 'tokenico_deployed_contracts' option. This enables any authenticated user with at least Subscriber privileges to overwrite smart contract addresses shown by the plugin, potentially misleading users or affecting contract interactions. The vulnerability affects all versions up to and including 2.4.7. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. No patch or vendor advisory is currently provided, and no exploits are known.

The vulnerability allows authenticated users with Subscriber-level access or higher to modify critical plugin data related to deployed smart contracts by overwriting the 'tokenico_deployed_contracts' WordPress option. This can lead to the display of incorrect or malicious smart contract addresses within the plugin interface, potentially misleading users or causing incorrect contract interactions. There is no direct impact on confidentiality or availability, but the integrity of displayed contract data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor changes to WordPress options related to the plugin. Consider disabling or removing the plugin if not essential. Avoid granting Subscriber-level or higher access to untrusted users to mitigate unauthorized modifications.