CVE-2025-1481 affects the Shortcode Cleaner Lite plugin for WordPress, specifically versions up to and including 1.0.9. This vulnerability, categorized as CWE-862 (Missing Authorization), allows authenticated attackers with subscriber-level access or higher to export arbitrary website options due to a missing capability check in the download_backup() function. The vulnerability has a CVSS score of 4.3 (Medium), indicating a low attack complexity and requiring low privileges, but with a limited impact on confidentiality (C:L). It is not currently listed in CISA's KEV catalog, nor is it on the Hot List. There is no known exploit intelligence, such as Metasploit modules or ExploitDB entries, and it shows minimal community discussion or media coverage, suggesting it is not actively exploited or widely known at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.0.9CPE matchmatch criteria | cpe:2.3:a:jozoor:shortcode_cleaner_lite:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.