WordPress Plugin Vulnerabilities

WP News Sliders <= 1.0 - Missing Authorization

Description

The WP News Sliders plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
wp-news-sliders
No known fix

References

CVE
CVE-2025-22779
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3e8bf22a-a2bf-411a-89b6-ffd576b22c9f

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Mika
Verified
No
WPVDB ID
7f563b74-ea9f-4d14-ba42-85c964622612

Timeline

Publicly Published
2025-01-14 (about 1 year ago)
Added
2025-01-21 (about 1 year ago)
Last Updated
2025-01-21 (about 1 year ago)

Other

Published
Title
Published
2025-06-05
Title
Elastic Email Subscribe Form <= 1.2.2 - Missing Authorization
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Arbitrary Plugin Deactivation
Published
2025-01-24
Title
ExactMetrics < 8.2.0 - Missing Authorization
Published
2026-01-13
Title
Aplazo Payment Gateway < 1.5.0 - Missing Authorization to Unauthenticated Order Status Manipulation
Published
2024-07-24
Title
Youzify < 1.2.8 - Missing Authorization