CVE-2025-13529
Unauthorized Data Modification in Unify WordPress Plugin via Missing Capability Check
Publication date: 2026-01-07
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| codeclouds | unify | to 3.4.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Unify plugin for WordPress exists because there is a missing capability check on the 'init' action in all versions up to and including 3.4.9. This flaw allows unauthenticated attackers to delete specific plugin options by using the 'unify_plugin_downgrade' parameter, leading to unauthorized modification of data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthenticated attackers to delete certain plugin options without permission. This unauthorized modification can disrupt the plugin's normal operation, potentially causing loss of configuration or functionality within your WordPress site that uses the Unify plugin.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Unify WordPress plugin to a version later than 3.4.9 where the missing capability check on the 'init' action is fixed. Until an update is applied, restrict access to the WordPress admin area and monitor for any unusual deletion of plugin options, especially those triggered by the 'unify_plugin_downgrade' parameter. Consider disabling or restricting the plugin if possible to prevent exploitation by unauthenticated attackers.