WordPress Plugin Vulnerabilities

Media Hygiene < 4.0.1 - Missing Authorization

Description

The Media Hygiene plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions like fn_wmh_fetch_statistics_data() in versions up to, and including, 4.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data and update settings.

Affects Plugins

Plugin icon
media-hygiene
Fixed in 4.0.1

References

CVE
CVE-2025-47469
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0aa925c8-7c65-45a4-95ca-a37290d74e86

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
domiee13
Verified
No
WPVDB ID
bf149076-9c20-4580-a4fc-a2126fb215f8

Timeline

Publicly Published
2025-05-07 (about 1 year ago)
Added
2025-05-12 (about 1 year ago)
Last Updated
2025-05-12 (about 1 year ago)

Other

Published
Title
Published
2024-10-09
Title
Notification for Telegram < 3.3.2 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message
Published
2026-01-23
Title
Monetag Official <= 1.1.3 - Missing Authorization
Published
2024-03-29
Title
Calendarista Basic Edition < 3.0.6 - Missing Authorization
Published
2026-01-26
Title
RegistrationMagic < 6.0.7.2 - Subscriber+ Form Creation
Published
2023-10-25
Title
My Shortcodes <= 2.3 - Missing Authorization via Multiple AJAX Actions