CVE-2025-8574

8.7 HIGH

Published 2026-10-30 · Updated 2026-10-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete core WordPress tables.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Weaknesses

CWE-284

All references

https://plugins.trac.wordpress.org/browser/database-cleaner/trunk/classes/rest.php#L765
https://plugins.trac.wordpress.org/changeset/3774510/
https://www.wordfence.com/threat-intel/vulnerabilities/id/22d6aa93-b265-41eb-9be9-cd066292f2ea?source=cve

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2013-10077PoC
MEDIUMCVE-2023-54412PoC
CRITICALCVE-2024-34320
HIGHCVE-2025-70962PoC
HIGHCVE-2026-100114
HIGHCVE-2026-100115
MEDIUMCVE-2026-100621PoC
CRITICALCVE-2026-100758

Related by shared AI tags and CWE weakness class. Browse the full archive.