WordPress Plugin Vulnerabilities

Revive.so < 2.0.7 - Missing Authorization

Description

The Revive.so – Bulk Rewrite and Republish Blog Posts plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
revive-so
Fixed in 2.0.7

References

CVE
CVE-2025-59551
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e0af864b-75aa-4384-b461-50bb11cfbf79

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nabil Irawan
Verified
No
WPVDB ID
ebd4f0f9-482a-4593-8ef0-ea7c84c8b3f2

Timeline

Publicly Published
2025-09-22 (about 11 months ago)
Added
2025-09-26 (about 10 months ago)
Last Updated
2025-09-26 (about 10 months ago)

Other

Published
Title
Published
2022-03-07
Title
Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure
Published
2023-08-01
Title
Booster for WooCommerce < 7.1.0 - Shop Manager+ Missing Authorization to Arbitrary Options Update
Published
2024-11-22
Title
WP User Manager – User Profile Builder & Membership < 2.9.12 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal
Published
2025-09-22
Title
Helpdesk Support Ticket System for WooCommerce < 2.1.2 - Missing Authorization
Published
2026-06-26
Title
Quiz and Survey Master (QSM) < 11.1.5 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action