CVE-2025-15476
Unknown Unknown - Not Provided
Unauthorized Data Modification in Bucketlister WordPress Plugin

Publication date: 2026-02-07

Last updated on: 2026-02-07

Assigner: Wordfence

Description
The The Bucketlister plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bucketlister_do_admin_ajax() function in all versions up to, and including, 0.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add delete or modify arbitrary bucket list items.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-07
Last Modified
2026-02-07
Generated
2026-06-16
AI Q&A
2026-02-07
EPSS Evaluated
2026-06-15
NVD
CVE-2025-15476
EUVD
EUVD-2025-206893
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
bucketlister bucketlister to 0.1.5 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Bucketlister plugin for WordPress has a vulnerability due to a missing capability check in the bucketlister_do_admin_ajax() function in all versions up to and including 0.1.5.

This flaw allows authenticated attackers with Subscriber-level access or higher to add, delete, or modify arbitrary bucket list items without proper authorization.

Impact Analysis

This vulnerability can lead to unauthorized modification of data within the Bucketlister plugin.

Attackers with low-level authenticated access (Subscriber-level) can manipulate bucket list items, potentially causing data integrity issues or unwanted changes on the affected WordPress site.

The CVSS score of 4.3 indicates a low to medium severity impact, primarily affecting data integrity but not confidentiality or availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15476. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart