WordPress Plugin Vulnerabilities

LWSCache < 2.9 - Subscriber+ Limited Plugin Activation

Description

The plugin is vulnerable to unauthorized modification of data due to improper authorization on the lwscache_activatePlugin() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate arbitrary whitelisted LWS plugins.

Affects Plugins

Plugin icon
lwscache
Fixed in 2.9

References

CVE
CVE-2025-8147
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/01a6a5bf-636b-416c-86fa-43f639624e80

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
wesley (wcraft)
Verified
No
WPVDB ID
a5772501-7d7c-4138-9bb1-99af9bbc4614

Timeline

Publicly Published
2025-08-28 (about 10 months ago)
Added
2025-08-28 (about 9 months ago)
Last Updated
2025-08-28 (about 9 months ago)

Other

Published
Title
Published
2022-05-09
Title
Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update
Published
2025-09-19
Title
Booking Manager < 2.1.15 - Contributor+ Booking Deletion
Published
2023-10-18
Title
BetterLinks < 1.6.1 - Improper Authorization to Data Import and Export
Published
2023-11-28
Title
WCMultiShipping < 2.3.8 - Subscriber+ Arbitrary Account Credentials Test
Published
2026-06-15
Title
RTMKit < 2.0.8 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter