Loading story…
An incorrect authorization vulnerability tracked as CVE-2025-3861 was disclosed in the Prevent Direct Access – Protect WordPress Files plugin for WordPress. The flaw stems from a misconfigured capability check in the pda_lite_custom_permission_check function, allowing authenticated users with Contributor-level access or higher to reach protected REST API endpoints that should have been more tightly restricted.
Successful exploitation lets those lower-privileged users change the protection status of media files, weakening access controls intended to protect WordPress content. The issue affects versions 2.8.6 through 2.8.8.2, is classified as CWE-863 (Incorrect Authorization), carries a CVSS 3.1 score of 5.4, and was fixed in version 2.8.8.3.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
WP Folio Team fixed an incorrect authorization flaw in the Prevent Direct Access – Protect WordPress Files WordPress plugin in version 2.8.8.3. The vulnerability allowed authenticated users with Contributor-level access or higher to access protected REST API endpoints and modify media protection settings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, **CVE-2025-14533**, was disclosed in the WordPress plugin *Advanced Custom Fields: Extended* affecting versions **<= 0.9.2.1**. The issue is an **unauthenticated privilege escalation** in the plugin’s user-form handling, where the `insert_user` logic does not properly restrict which roles can be assigned during registration; as a result, an attacker can submit a registration request specifying the **`administrator`** role and obtain full administrative access under certain configurations. Reporting indicates exploitation depends on site configuration: the flaw is reachable when a form is set up such that the **`role`** value is mapped to a custom field / user role field is present in the form. The weakness was identified by **Andrea Bocchetti** via the **Wordfence Bug Bounty Program**, and is associated with **CWE-269 (Improper Privilege Management)**; once admin access is obtained, attackers can fully compromise the site (e.g., upload malicious plugins/themes, plant backdoors, or alter content for redirects).
Jun 29, 2026
A critical privilege-escalation vulnerability, **CVE-2026-19598**, has been disclosed in the **Pods – Custom Content Types and Fields** WordPress plugin, affecting all versions up to and including `3.3.9` and putting roughly **100,000 sites** at risk. The flaw lies in the plugin’s `pods_admin` AJAX router, where authorization and validation failures can be mishandled under a JSON compatibility path involving the `meta-box-loader` parameter, allowing unauthenticated attackers to bypass login, nonce, capability, and method restrictions. Successful exploitation can let attackers invoke privileged API methods such as `save_user`, reset arbitrary user passwords, and gain administrator access, leading to full site takeover. The vendor released patched versions `2.8.23.4`, `2.9.19.4`, `3.0.10.4`, `3.1.4.2`, `3.2.8.3`, and `3.3.9.1`, while detection coverage has also begun appearing in the security community through a Nuclei template pull request tracking the issue. Wordfence said firewall protections were deployed for paid users immediately after disclosure, with broader free-user coverage scheduled later.
Aug 27, 2026
A high-severity vulnerability tracked as **`CVE-2026-15991`** affects the Bitpressadmin **File Manager** plugin for WordPress in versions **6.0 through 6.9**, allowing authenticated users with **subscriber-level access or higher** to read and delete arbitrary files on the server. The bug is a **missing authorization** issue caused by inconsistent handling of command parameters: elFinder registers permissions based on `$_POST`, while the plugin dispatcher executes commands from merged `$_GET` and `$_POST` input, letting attackers bypass checks by placing commands such as `rm` or `file` in the query string.
Aug 6, 2026