WordPress Plugin Vulnerabilities

Permalink Manager Lite < 2.5.1.4 - Unauthenticated Sensitive Information Exposure

Description

The plugin is vulnerable to Sensitive Information Exposure. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
permalink-manager
Fixed in 2.5.1.4

References

CVE
CVE-2025-59010
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/fa4ac740-8f57-4d0c-8e04-dcddeeb3c89e

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Que Thanh Tuan - Blue Rock
Verified
No
WPVDB ID
233f3235-a728-4369-8d3c-535b3cb0962b

Timeline

Publicly Published
2025-09-06 (about 8 months ago)
Added
2025-10-16 (about 6 months ago)
Last Updated
2025-10-16 (about 6 months ago)

Other

Published
Title
Published
2025-06-05
Title
KI Live Video Conferences <= 5.5.15 - Unauthenticated Information Disclosure
Published
2024-07-02
Title
Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure
Published
2025-10-02
Title
RestroPress – Online Food Ordering System < 3.2.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
Published
2023-12-13
Title
Debug Log Manager < 2.3.0 - Sensitive Logs Exposure
Published
2024-08-28
Title
Premium SEO Pack – WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposure