CVE-2025-8423

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8423", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-31T15:11:46.654Z", "datePublished": "2025-09-11T07:24:54.340Z", "dateUpdated": "2026-04-08T16:55:27.773Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:27.773Z"}, "affected": [{"vendor": "mythemeshop", "product": "My WP Translate", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt_remove_plugin() and ajax_update_export_code() functions in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete arbitrary WordPress options which can cause a denial of service."}], "title": "My WP Translate <= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bda56c3-56ad-40d7-b743-0b69512ec460?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1138"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1069"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1130"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1048"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Arkadiusz Hydzik"}], "timeline": [{"time": "2025-09-10T19:03:38.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:04:45.421952Z", "id": "CVE-2025-8423", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:39:52.532Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8423", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T14:04:45.421952Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:05:07.246Z"}}], "cna": {"title": "My WP Translate <= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Arkadiusz Hydzik"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "mythemeshop", "product": "My WP Translate", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-10T19:03:38.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bda56c3-56ad-40d7-b743-0b69512ec460?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1138"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1069"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1130"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1048"}], "descriptions": [{"lang": "en", "value": "The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt_remove_plugin() and ajax_update_export_code() functions in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete arbitrary WordPress options which can cause a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:27.773Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8423", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:55:27.773Z", "dateReserved": "2025-07-31T15:11:46.654Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T07:24:54.340Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "My WP Translate", "vendor": "mythemeshop", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt_remove_plugin() and ajax_update_export_code() functions in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete arbitrary WordPress options which can cause a denial of service."}], "id": "CVE-2025-8423", "lastModified": "2026-06-17T10:06:57.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8423", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T14:04:45.421952Z", "version": "2.0.3"}}]}, "published": "2025-09-11T08:15:34.077", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1048"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1069"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1130"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1138"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bda56c3-56ad-40d7-b743-0b69512ec460?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:02:51.068917+00:00", "value": {"mitigation_remediation": ["Update My WP Translate to the latest version released after 1.1, or uninstall the plugin if no upgrade is available.", "Temporarily block the affected AJAX calls (mtswpt_remove_plugin and ajax_update_export_code) by adding a custom plugin or code snippet that checks the current user's capabilities before allowing execution; this serves as a workaround until a patch is applied.", "Review the WordPress options table for entries created by the plugin, back up the database, and remove any redundant or sensitive options that could be targeted.", "Monitor site logs for unusual option read or delete requests and alert administrators of suspicious activity."], "summary": {"action": "Immediate Patch", "impact": "Data Tampering and Denial of Service"}, "threat_synthesis": {"affected_systems": "The flaw is present in all releases of My WP Translate from the initial version through 1.1, distributed by My Theme Shop. WordPress sites running any of these versions are susceptible. No specific WordPress core or PHP version requirements were noted, so the affected environment is any WordPress installation that hosts the plugin.", "description_and_impact": "The vulnerability resides in the My WP Translate plugin for WordPress, where certain functions bypass the required capability check, allowing any user with Subscriber privileges or higher to manipulate site options. By executing the malicious actions, an attacker can read configuration values or delete arbitrary options, potentially rendering the site unstable or unavailable. This flaw aligns with the CWE-862 classification of Missing Authorization.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a moderate threat, while the EPSS score of less than 1% signifies that exploitation is unlikely in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Attackers must be authenticated with a Subscriber role or higher, after which they can issue requests to the plugin's admin actions to read or delete options, thereby causing integrity or availability issues."}}}}, "created": "2025-09-12T08:03:01.700958+00:00", "updated": "2026-04-21T03:15:16.326654+00:00", "vendors": ["mythemeshop", "mythemeshop$PRODUCT$my_wp_translate", "wordpress", "wordpress$PRODUCT$wordpress"]}