CVE-2025-10008 Overview
CVE-2025-10008 affects the Translate WordPress and go Multilingual – Weglot plugin for WordPress. The plugin fails to enforce a capability check on the clean_options function in all versions up to and including 5.1. Unauthenticated attackers can invoke the function to delete transients that cache plugin options. The flaw maps to CWE-862: Missing Authorization and impacts integrity while leaving confidentiality and availability of the broader system intact.
Critical Impact
Unauthenticated remote attackers can trigger deletion of cached Weglot plugin transients, causing limited data loss and forcing the plugin to regenerate cached options.
Affected Products
- Translate WordPress and go Multilingual – Weglot plugin for WordPress, versions up to and including 5.1
- WordPress sites with the Weglot plugin activated
- Multilingual WordPress deployments relying on Weglot cached options
Discovery Timeline
- 2025-10-30 - CVE-2025-10008 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10008
Vulnerability Analysis
The vulnerability resides in the clean_options function defined in src/actions/front/class-clean-options.php of the Weglot plugin. The function is registered as a front-end action but does not verify the caller's WordPress capabilities before performing state-changing operations. As a result, any anonymous HTTP request that reaches the handler executes the option-clearing logic without authentication. The function deletes transients that store cached Weglot configuration, forcing the plugin to rebuild its cache on the next request. The impact is bounded to integrity of these transient values, which explains the limited scope reflected in the plugin's threat model.
Root Cause
The root cause is a missing authorization control [CWE-862]. WordPress plugins that expose sensitive actions through public hooks must gate them with a current_user_can() check or a valid nonce. The pre-patch version of class-clean-options.php invokes transient deletion without either safeguard, so the security boundary between anonymous visitors and privileged administrators is absent for this operation.
Attack Vector
Exploitation requires only network access to the WordPress site. An attacker sends an unauthenticated HTTP request that triggers the front-end action bound to clean_options. The handler executes and deletes the targeted transients. Repeated requests can be used to continuously invalidate the plugin's option cache, imposing regeneration overhead and interfering with configuration persistence. No user interaction, credentials, or elevated privileges are required.
No verified public proof-of-concept code is available. Technical details are documented in the WordPress plugin code reference and the Wordfence vulnerability report.
Detection Methods for CVE-2025-10008
Indicators of Compromise
- Unauthenticated HTTP requests to WordPress front-end endpoints that invoke Weglot actions associated with clean_options
- Unexpected deletion or regeneration of Weglot-related transients in the WordPress wp_options table
- Elevated frequency of cache rebuild operations logged by the Weglot plugin
Detection Strategies
- Inspect web server access logs for anonymous POST or GET requests that trigger Weglot admin-ajax or front-end action handlers
- Monitor database write activity targeting rows with the _transient_weglot_ prefix in wp_options
- Correlate spikes in Weglot cache regeneration with request bursts from a single source IP
Monitoring Recommendations
- Enable WordPress audit logging for option and transient modifications
- Alert on repeated requests to Weglot action endpoints from unauthenticated sessions
- Track plugin version inventory to identify hosts still running Weglot 5.1 or earlier
How to Mitigate CVE-2025-10008
Immediate Actions Required
- Update the Weglot plugin to the version released in WordPress changeset #3383165 or later
- Audit WordPress sites for the installed Weglot plugin version and prioritize upgrades of internet-facing instances
- Review web server and database logs for evidence of unauthenticated invocations of the clean_options handler
Patch Information
The Weglot maintainers addressed the missing capability check in the commit tracked as WordPress changeset #3383165. The patched code introduces an authorization check that prevents unauthenticated callers from executing the transient-clearing logic. Site operators should upgrade to the first Weglot release that contains this changeset. Reference details are also published in the Wordfence vulnerability report.
Workarounds
- Deactivate the Weglot plugin until the patched version can be installed
- Restrict access to WordPress action endpoints using a web application firewall rule that blocks unauthenticated invocations of Weglot handlers
- Rate-limit requests to wp-admin/admin-ajax.php and front-end action routes from anonymous sources
# Example WAF rule concept: block unauthenticated requests targeting the vulnerable action
# Adjust the action name to match the parameter used by the Weglot handler in your environment
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
"chain,deny,status:403,id:1010008,msg:'Block unauthenticated Weglot clean_options invocation'"
SecRule ARGS:action "@rx weglot_clean_options" \
"chain"
SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
