PT-2025-43720 · WordPress · Advanced Database Cleaner

Published 2025-10-25 · Updated 2025-10-25 · CVE-2025-11497

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advanced Database Cleaner plugin for WordPress versions up to and including 3.1.6

Description The Advanced Database Cleaner plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is caused by insufficient or incorrect nonce validation within the aDBc prepare elements to clean() function. An unauthenticated attacker could potentially modify the 'keep last' setting by crafting a malicious request and tricking a site administrator into triggering an action, such as clicking a link.

Recommendations Update the Advanced Database Cleaner plugin to a version newer than 3.1.6.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-11497

Affected Products

Advanced Database Cleaner

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-11497 · Security Note
• https://t.me/cveNotify/140345 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1982027198568538315 · Twitter Post
• https://t.me/CVEtracker/35740 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3382581%40advanced-database-cleaner&new=3382581%40advanced-database-cleaner&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1981982754431500414 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4f4635ac-2ce6-4135-8d2b-d03b42860f05?source=cve · Note