PT-2025-46263 · WordPress · Ctl Arcade Lite

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-11886

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CTL Arcade Lite plugin for WordPress versions prior to 1.1

Description The software is susceptible to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'ctl arcade lite page manage games' page. This allows unauthenticated attackers to deactivate and activate plugins by tricking a site administrator into performing an action, such as clicking a link. The affected API endpoint is 'ctl arcade lite page manage games'.

Recommendations Update to version 1.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-11886

Affected Products

Ctl Arcade Lite

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-11886 · Security Note
• https://twitter.com/CVEnew/status/1988095335663546839 · Twitter Post
• https://wordpress.org/plugins/ctl-arcade-lite · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/44bca8c2-1591-484c-ac40-8c968d5d1cad?source=cve · Note