Vulnerability Description
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete core WordPress tables.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/database-cleaner/trunk/classes/rest.p
- https://plugins.trac.wordpress.org/changeset/3774510/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/22d6aa93-b265-41eb-9be
FAQ
What is CVE-2025-8574?
CVE-2025-8574 is a vulnerability with a CVSS score of 8.7 (HIGH). The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be del...
How severe is CVE-2025-8574?
CVE-2025-8574 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-8574?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.