Live › vulnerability › CVE-2025-8574
The Database Cleaner plugin for WordPress, up to and including version 1.4.7, does not restrict which database tables can be deleted. A logged-in administrator can delete core WordPress tables, which can take the site down or destroy its content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Only WordPress sites that have the Database Cleaner plugin installed at version 1.4.7 or lower are exposed. The attacker needs an Administrator account or higher on that site. Sites without the plugin are not affected.
No product ranges from the sources yet.
Database Cleaner plugin is installed and its version is 1.4.7 or lower in the WordPress admin plugins listNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete core WordPress tables.
This page as .md · .json · in your agent: get_signal("CVE-2025-8574")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.