CVE-2026-0572
Unauthorized Data Modification in WebPurify Plugin via Missing Capability Check
Publication date: 2026-02-04
Last updated on: 2026-02-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| webpurify | webpurify_profanity_filter | to 4.0.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WebPurify Profanity Filter plugin for WordPress has a vulnerability due to a missing capability check on the 'webpurify_save_options' function in all versions up to and including 4.0.2.
This means that unauthenticated attackers can modify the plugin's settings without proper authorization.
How can this vulnerability impact me? :
Because the vulnerability allows unauthenticated attackers to change plugin settings, it can lead to unauthorized modification of how profanity filtering is applied on your WordPress site.
This could result in inappropriate content not being filtered properly or other malicious configurations that affect site content moderation.
Additionally, the CVSS score indicates a moderate impact with integrity and availability impacts, meaning attackers could alter data and potentially disrupt service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability involves unauthorized modification of plugin settings due to a missing capability check in the 'webpurify_save_options' function of the WebPurify Profanity Filter WordPress plugin. Detection would involve monitoring for unauthorized changes to the plugin's configuration or suspicious POST requests to the WordPress admin options page related to WebPurify settings."}, {'type': 'paragraph', 'content': 'Since the plugin settings can be changed without authentication, one way to detect exploitation attempts is to monitor HTTP requests targeting the admin options endpoint for the WebPurify plugin, looking for POST requests that modify settings without proper authentication.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect suspicious activity on a Linux server hosting WordPress might include:'}, {'type': 'list_item', 'content': 'Using web server access logs to search for POST requests to the WebPurify options page, e.g.:'}, {'type': 'list_item', 'content': "grep -i 'POST.*webpurifytextreplace-options.php' /var/log/apache2/access.log"}, {'type': 'list_item', 'content': 'Checking for recent changes in plugin option data in the WordPress database (usually in the wp_options table) related to WebPurify settings.'}, {'type': 'list_item', 'content': 'Using WP-CLI to inspect plugin options, for example:'}, {'type': 'list_item', 'content': 'wp option get webpurify_userkey'}, {'type': 'list_item', 'content': 'Monitoring for unexpected changes in these options could indicate exploitation.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate this vulnerability, immediate steps include:'}, {'type': 'list_item', 'content': 'Update the WebPurify Profanity Filter plugin to a version later than 4.0.2 where the missing capability check is fixed, if such an update is available.'}, {'type': 'list_item', 'content': 'If an update is not yet available, restrict access to the WordPress admin options page for the WebPurify plugin by limiting access to trusted administrators only.'}, {'type': 'list_item', 'content': "Implement additional access controls at the web server or firewall level to block unauthorized POST requests targeting the plugin's options page."}, {'type': 'list_item', 'content': 'Monitor logs for suspicious activity as described in the detection section to identify potential exploitation attempts.'}, {'type': 'list_item', 'content': 'Consider temporarily disabling the WebPurify Profanity Filter plugin if the risk of exploitation is high and no patch is available.'}] [2]