WordPress Plugin Vulnerabilities

Widget Manager Light <= 1.18 - Missing Authorization

Description

The Widget Manager Light plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.18. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
widget-manager-light
No known fix

References

CVE
CVE-2025-31768
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ab2a011e-73c5-4fb9-a8d2-aaa2756d93f9

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Skalucy
Verified
No
WPVDB ID
4345785c-251e-4109-b9ce-d5da65dbae88

Timeline

Publicly Published
2025-04-02 (about 1 year ago)
Added
2025-04-08 (about 1 year ago)
Last Updated
2025-04-08 (about 1 year ago)

Other

Published
Title
Published
2026-02-17
Title
Kali Forms < 2.4.9 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure
Published
2026-08-17
Title
WP Table Builder – Drag & Drop Table Builder < 2.2.1 - Missing Authorization
Published
2025-04-15
Title
JetBlog < 2.4.3.1 - Missing Authorization
Published
2025-01-24
Title
Internal Links Manager < 2.5.3 - Missing Authorization
Published
2026-06-18
Title
Classified Listing < 5.4.3 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)