CVE-2025-11894 Overview
CVE-2025-11894 affects the Shelf Planner plugin for WordPress in all versions up to and including 2.8.1. The plugin fails to enforce capability checks on several REST API endpoints, allowing unauthenticated attackers to modify plugin settings. Attackers can alter sensitive configuration values such as the ServerKey and LicenseKey without any authentication. The weakness is categorized under CWE-862: Missing Authorization.
Critical Impact
Unauthenticated attackers can modify Shelf Planner configuration values including ServerKey and LicenseKey by sending crafted requests to unprotected REST API endpoints.
Affected Products
- Shelf Planner plugin for WordPress
- All versions up to and including 2.8.1
- WordPress sites running the vulnerable plugin
Discovery Timeline
- 2025-11-11 - CVE-2025-11894 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11894
Vulnerability Analysis
The Shelf Planner plugin registers several REST API endpoints without applying a permission_callback that validates the caller's capabilities. WordPress REST API routes require an explicit authorization check via the permission_callback argument in register_rest_route(). When the callback is missing or returns a permissive value, any HTTP client can invoke the route.
This specific instance permits unauthenticated modification of plugin configuration. Attackers can overwrite the ServerKey and LicenseKey values persisted by the plugin. Overwriting these values can disrupt plugin functionality, redirect integrations to attacker-controlled endpoints, or invalidate legitimate licensing. The confidentiality impact is none, but integrity of plugin configuration is compromised.
Root Cause
The root cause is a missing authorization control on REST API routes registered by the plugin. The route handlers accept and process write operations without verifying that the requester holds an administrative capability such as manage_options. This is a classic [CWE-862] Missing Authorization pattern in WordPress plugin development.
Attack Vector
The attack is exploitable over the network with low complexity and no privileges. An attacker sends an HTTP request to the affected REST endpoint on a vulnerable WordPress site. The request updates plugin options directly. No user interaction is required. See the Wordfence Vulnerability Report for further technical detail.
Detection Methods for CVE-2025-11894
Indicators of Compromise
- Unexpected changes to Shelf Planner plugin options, especially ServerKey and LicenseKey values in the wp_options table.
- Unauthenticated POST or PUT requests to /wp-json/ routes registered by the Shelf Planner plugin.
- WordPress activity logs showing option updates without an associated authenticated user session.
Detection Strategies
- Inspect web server access logs for requests to Shelf Planner REST endpoints from unauthenticated sources.
- Compare current plugin option values against known-good baselines to identify tampering.
- Audit register_rest_route() invocations in the plugin source to confirm which routes lack a permission_callback.
Monitoring Recommendations
- Enable WordPress audit logging to capture option modifications with timestamps and source IP addresses.
- Alert on any 200 responses to REST API endpoints exposed by the Shelf Planner plugin from anonymous clients.
- Monitor outbound connections from the WordPress host for traffic to unfamiliar hosts referenced by modified ServerKey values.
How to Mitigate CVE-2025-11894
Immediate Actions Required
- Update the Shelf Planner plugin to a version later than 2.8.1 once the vendor releases a fix.
- Deactivate and remove the plugin if no patched version is yet available and the functionality is not required.
- Restore ServerKey and LicenseKey to their legitimate values if tampering is confirmed.
Patch Information
At the time of publication, the Wordfence Vulnerability Report and WordPress Plugin Documentation should be consulted for the latest patched release. Administrators should apply the vendor update as soon as a fixed version becomes available.
Workarounds
- Block access to Shelf Planner REST API routes at the web application firewall or reverse proxy layer until a patch is applied.
- Restrict access to /wp-json/ endpoints to authenticated administrative sessions via server-level authentication rules.
- Temporarily deactivate the plugin to eliminate the exposed endpoints until a fixed release is installed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
