PT-2026-8047 · WordPress · Wp Last Modified Info

Itthidej Aramsri · Published 2026-02-14 · Updated 2026-02-14 · CVE-2025-14608

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Last Modified Info plugin for WordPress versions up to and including 1.9.5

Description The WP Last Modified Info plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. The plugin does not properly validate a user’s access rights to a post before altering its metadata within the 'bulk save' AJAX action. This allows authenticated attackers with Author-level access or higher to modify the last modified metadata and lock the modification date of any post, even those created by Administrators. The manipulation is performed through the post ids parameter.

Recommendations Update the WP Last Modified Info plugin to a version later than 1.9.5.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14608

Affected Products

Wp Last Modified Info

References · 11

• https://osv.dev/vulnerability/CVE-2025-14608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14608 · Security Note
• https://github.com/iamsayan/wp-last-modified-info/commit/cb3586897c11c3cd55dd63b7ae963243a027c0be · Note
• https://plugins.trac.wordpress.org/browser/wp-last-modified-info/tags/1.9.5/inc/Core/Backend/EditScreen.php#L249 · Note
• https://t.me/CVEtracker/44676 · Telegram Post
• https://twitter.com/CVEnew/status/2022543946870600011 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3450167 · Note
• https://twitter.com/CVEarity/status/2022651556144074810 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ca94c815-488f-4d86-a642-39d2de803763?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-last-modified-info/trunk/inc/Core/Backend/EditScreen.php#L249 · Note
• https://twitter.com/VulmonFeeds/status/2022612095263518958 · Twitter Post