WordPress Plugin Vulnerabilities

CM On Demand Search And Replace <= 1.5.4 - Missing Authorization

Description

The CM On Demand Search And Replace plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
cm-on-demand-search-and-replace
No known fix

References

CVE
CVE-2025-54045
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/13ba9474-b1ca-4ba4-ad94-88f7795a4c3c

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Kévin Mosbahi (Mika)
Verified
No
WPVDB ID
58a2831b-6b29-4a7c-a330-6fbe39bc045b

Timeline

Publicly Published
2025-06-30 (about 10 months ago)
Added
2025-12-19 (about 5 months ago)
Last Updated
2026-03-06 (about 2 months ago)

Other

Published
Title
Published
2024-07-23
Title
WP Easy Pay (Free) < 4.2.4 - Missing Authorization to Unauthenticated Service Disconnection
Published
2024-06-24
Title
Zita Elementor Site Library < 1.6.3 - Missing Authorization to Page Creation and Options Modification
Published
2024-03-11
Title
LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.4 - Missing Authorization on publish_lp()
Published
2024-12-05
Title
Ultimate Coming Soon & Maintenance < 1.1.0 - Unauthenticated Template Activation
Published
2023-06-05
Title
KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls