WordPress Plugin Vulnerabilities

F4 Media Taxonomies < 1.1.5 - Missing Authorization

Description

The F4 Media Taxonomies plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
f4-media-taxonomies
Fixed in 1.1.5

References

CVE
CVE-2025-58617
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f98aad51-a08e-4eea-84f7-345f2442081a

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nabil Irawan
Verified
No
WPVDB ID
072db646-e400-432c-ae16-fbd6468b502f

Timeline

Publicly Published
2025-09-03 (about 1 year ago)
Added
2025-09-09 (about 1 year ago)
Last Updated
2025-09-09 (about 1 year ago)

Other

Published
Title
Published
2024-04-24
Title
PropertyHive < 2.0.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Published
2024-06-05
Title
Countdown, Coming Soon, Maintenance – Countdown & Clock < 2.7.8.1 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection
Published
2025-01-30
Title
Live2DWebCanvas < 1.9.12 - Subscriber+ Arbitrary File Deletion
Published
2026-09-14
Title
Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint
Published
2025-12-03
Title
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution < 1.10.0 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management