WordPress Plugin Vulnerabilities

RapidLoad < 2.4.5 - Missing Authorization

Description

The RapidLoad plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the rapidload_switch_test_mode() function in versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to switch to test mode.

Affects Plugins

Plugin icon
unusedcss
Fixed in 2.4.5

References

CVE
CVE-2025-22665
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6f24c2f1-be36-4d64-8f2e-ce27dfc697e3

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Hakiduck
Verified
No
WPVDB ID
17dfa4c3-378e-4908-99de-20d197135f83

Timeline

Publicly Published
2025-02-03 (about 1 year ago)
Added
2025-02-12 (about 1 year ago)
Last Updated
2025-02-12 (about 1 year ago)

Other

Published
Title
Published
2025-11-21
Title
Appointment Booking Calendar < 1.3.97 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter
Published
2026-05-26
Title
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers < 3.6.8 - Missing Authorization
Published
2025-03-07
Title
Shortcode Cleaner Lite <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Export
Published
2025-10-03
Title
Cost Calculator Builder < 3.5.33 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions
Published
2023-10-25
Title
WP EXtra < 6.3 - Missing Authorization to Arbitrary Email Sending