WordPress Plugin Vulnerabilities

Page View Count < 2.9.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update

Description

The Page View Count plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings.

Affects Plugins

Plugin icon
page-views-count
Fixed in 2.9.2

References

CVE
CVE-2025-63034
URL
https://patchstack.com/database/Wordpress/Plugin/page-views-count/vulnerability/wordpress-page-view-count-plugin-2-8-7-settings-change-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Phat RiO - BlueRock
Verified
No
WPVDB ID
335ce0d8-c185-499d-8abe-482585fe9f5f

Timeline

Publicly Published
2025-12-08 (about 8 months ago)
Added
2025-12-11 (about 8 months ago)
Last Updated
2026-08-04 (about 19 days ago)

Other

Published
Title
Published
2026-01-15
Title
Awesome Support – WordPress HelpDesk & Support Plugin < 6.3.7 - Missing Authorization to Unauthenticated Role Demotion
Published
2023-11-14
Title
Betheme < 27.1.2 - Missing Authorization
Published
2021-12-20
Title
Tabs < 3.6.0 - Unauthenticated Arbitrary Option Update
Published
2026-05-28
Title
Quads Ads Manager for Google AdSense < 3.0.3 - Missing Authorization
Published
2024-07-01
Title
Noptin < 3.4.3 - Missing Authorization to Unauthenticated Form Submission