CVE-2025-11497
BaseFortify
Publication date: 2025-10-25
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | advanced_database_cleaner | 3.1.6 |
| wordpress | advanced_database_cleaner | 3.1.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Advanced Database Cleaner WordPress plugin versions up to 3.1.6. It occurs because the plugin's function aDBc_prepare_elements_to_clean() lacks proper nonce validation, which is a security measure to verify that requests are legitimate. As a result, an attacker can trick a site administrator into performing unintended actions, such as changing the 'keep last' setting, by sending a forged request that the administrator unknowingly executes. [1]
How can this vulnerability impact me? :
This vulnerability can allow an unauthenticated attacker to alter database cleanup settings on your WordPress site by tricking an administrator into clicking a malicious link. Specifically, the attacker can change the 'keep last' setting, potentially affecting how many database items are retained or cleaned. This could lead to unintended data modifications or loss, impacting site stability or data integrity. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the version of the Advanced Database Cleaner plugin installed on your WordPress site. Versions up to and including 3.1.6 are vulnerable. To check the plugin version, you can use WP-CLI with the command: `wp plugin list --format=json` and look for 'advanced-database-cleaner' version. Additionally, inspecting HTTP requests for missing nonce fields in forms related to the 'keep_last' setting could indicate vulnerability to CSRF. However, no specific network detection commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Advanced Database Cleaner plugin to version 3.1.7 or later, where the vulnerability is fixed by adding proper nonce verification to prevent CSRF attacks. Until the update is applied, avoid clicking on suspicious links or performing actions related to the 'keep_last' setting in the plugin. Also, ensure that only trusted administrators have access to the WordPress admin area. [1]