CVE-2025-10476

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpfc_db_fix_callback() function in all versions up to, and including, 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate several database fix actions. This only affects sites with premium activated.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-104779.8A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The affected element is an un CVE-2025-104799.8A security flaw has been discovered in SourceCodester Online Student File Management System 1.0. The impacted element is an unknown function CVE-2025-10488.8Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to ex CVE-2025-104809.8A weakness has been identified in SourceCodester Online Student File Management System 1.0. This affects an unknown function of the file /sa CVE-2025-104818.8A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. This impacts an unknown function of CVE-2025-104829.8A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin CVE-2025-104838.8A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an unknown functionalit CVE-2025-104849.8The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all version CVE-2025-104854.3A vulnerability has been found in pojoin h3blog up to 5bf704425ebc11f4c24da51f32f36bb17ae20489. Affected by this issue is the function ppt_l CVE-2025-104865.3The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through CVE-2025-104877.3The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.CVE-2025-104888.1The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move