PT-2025-18351 · WordPress · Page View Count

Kenneth Dunn · Published 2025-05-01 · Updated 2025-05-01 · CVE-2025-2816

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Page View Count plugin for WordPress versions 2.8.0 through 2.8.4

Description The issue allows authenticated attackers with Subscriber-level access and above to modify data due to a missing capability check on the yellow message dontshow() function. This can lead to a denial of service by updating option values, creating an error on the site, or setting certain values to true, such as registration, thereby denying service to legitimate users.

Recommendations For versions 2.8.0 through 2.8.4, consider disabling the yellow message dontshow() function as a temporary workaround until a patch is available to prevent unauthorized modification of data. Restrict access to option value updates to minimize the risk of exploitation.

Fix

DoS

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-2816

Affected Products

Page View Count

References · 9

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3282975%40page-views-count&new=3282975%40page-views-count&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-2816 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2816 · Vendor Advisory
• https://t.me/cvenotify/120429 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e6fb9558-06e5-4297-93df-ee9a6971f0ec?source=cve · Note
• https://t.me/cvetracker/22779 · Telegram Post
• https://t.me/latest_high_impact_cve/2237 · Telegram Post
• https://t.me/cvedetector/24177 · Telegram Post
• https://twitter.com/cybercronai/status/1918021483332256192 · Twitter Post