Unauthorized Data Modification in Profiler Plugin for WordPress

CVE-2025-5814

What is CVE-2025-5814?

The Profiler – What Slowing Down Your WP plugin for WordPress is susceptible to unauthorized modification of data. This vulnerability is rooted in a missing capability check for the wpsd_plugin_control() function across all versions up to and including 1.0.0. As a result, unauthenticated attackers can exploit this flaw to reactivate previously deactivated plugins after navigating to the 'Profiler' page. This poses a significant security risk, as unauthorized modifications can lead to further exploitation of the WordPress environment.

References