Unauthorized Data Modification in LWSCache Plugin for WordPress

CVE-2025-8147

What is CVE-2025-8147?

The LWSCache plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level permissions and higher to exploit improper authorization in the lwscache_activatePlugin() function. This flaw can be manipulated to activate arbitrary plugins that are whitelisted by the LWSCache, potentially leading to unauthorized data modifications and altering the site's functionality. Users are encouraged to update to the latest version to mitigate this risk.

References