---
id: "CVE-2025-8574"
kind: "vulnerability"
aliases: ["CVE-2025-8574"]
title: "WordPress Database Cleaner plugin lets admins delete core WordPress tables"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["runtime", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["non-admin-users-only", "plugin-not-installed"]
published_at: "2026-10-30T18:17:13+00:00"
first_seen_at: "2026-10-30T18:55:28+00:00"
updated_at: "2026-10-30T18:56:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8574", "first_seen_at": "2026-10-30T18:55:28+00:00"}]
---

# WordPress Database Cleaner plugin lets admins delete core WordPress tables

The Database Cleaner plugin for WordPress, up to and including version 1.4.7, does not restrict which database tables can be deleted. A logged-in administrator can delete core WordPress tables, which can take the site down or destroy its content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `Database Cleaner` plugin is installed and its version is `1.4.7` or lower in the WordPress admin plugins list

## Timeline

- 2026-10-30T18:55:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-8574

## From the sources

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete core WordPress tables.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_