The odude Crypto Tool WordPress plugin registers an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that permits calling critical methods (register and savenft) with only a publicly available nonce check but no wallet signature verification. This missing authentication allows attackers to set a site-wide global authentication transient, bypassing all access controls for all visitors for one hour. Additionally, attackers can inject arbitrary data into the plugin's custom_users table, potentially impacting site integrity.

The vulnerability leads to a complete bypass of the [crypto-block] shortcode restrictions and page-level access controls for all site visitors for one hour. It also allows injection of arbitrary data into the plugin's custom_users table. The CVSS score is 5.3 (medium), indicating limited confidentiality impact, no integrity or availability impact, and no privileges or user interaction required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, site administrators should monitor the vendor's advisories for updates. Until a fix is available, consider disabling the vulnerable plugin or restricting access to the affected AJAX actions if possible.