PT-2025-37129 · Mythemeshop · My-Wp-Translate

Arkadiusz Hydzik · Publicado 2025-09-11 · Atualizado 2025-09-11 · CVE-2025-8423

Mitre

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt remove plugin() and ajax update export code() functions in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete arbitrary WordPress options which can cause a denial of service.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-8423

Produtos afetados

My-Wp-Translate

Referências · 6

• https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1069 · Nota
• https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1138 · Nota
• https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1130 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/5bda56c3-56ad-40d7-b743-0b69512ec460?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1048 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-8423 · Nota de Segurança