CVE-2025-2816 Overview
CVE-2025-2816 affects the Page View Count plugin for WordPress, versions 2.8.0 through 2.8.4. The vulnerability stems from a missing capability check on the yellow_message_dontshow() function. Authenticated users with Subscriber-level access or higher can modify arbitrary WordPress option values, setting them to 1. Attackers can leverage this to trigger site errors that deny service to legitimate users or to enable sensitive settings such as open user registration. The flaw is classified under [CWE-862] Missing Authorization and originates from the WordPress plugin vendor a3rev.
Critical Impact
Low-privilege authenticated attackers can disrupt site availability and toggle sensitive WordPress options including user registration.
Affected Products
- A3rev Page View Count plugin for WordPress version 2.8.0
- A3rev Page View Count plugin for WordPress versions 2.8.1 through 2.8.3
- A3rev Page View Count plugin for WordPress version 2.8.4
Discovery Timeline
- 2025-05-01 - CVE-2025-2816 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2816
Vulnerability Analysis
The Page View Count plugin exposes an AJAX-accessible handler named yellow_message_dontshow(). This function updates a WordPress option but does not call current_user_can() or any equivalent capability check before performing the update. The handler accepts an option name from the request and writes the value 1 using the WordPress update_option() API.
Because the only authentication requirement is a valid logged-in session, any user with Subscriber privileges or higher can invoke the function. The Subscriber role is the lowest privilege tier and is often auto-assigned through open registration. This significantly lowers the bar for exploitation on sites that allow registration. The impact extends beyond the plugin's own configuration because the handler does not restrict which option keys can be modified.
Root Cause
The root cause is a missing authorization check [CWE-862] on a state-changing function. The developer relied on authentication alone and did not enforce role-based access controls or nonce validation that would limit who can invoke the endpoint or which options can be written.
Attack Vector
An attacker authenticates as a Subscriber, then sends a crafted request to the plugin's AJAX endpoint targeting yellow_message_dontshow(). By specifying an option name through the request parameters, the attacker forces the value of that option to 1. Setting critical options such as users_can_register to 1 enables open registration. Setting options that the plugin or theme expects to be strings or arrays to the integer 1 causes fatal errors and denial of service. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-2816
Indicators of Compromise
- Unexpected changes to the wp_options table, particularly options whose value was changed to the integer 1.
- The WordPress users_can_register option set to 1 without an administrator initiating the change.
- Sudden site-wide fatal errors or white screens following an authenticated request to admin-ajax.php.
- POST requests to admin-ajax.php referencing the yellow_message_dontshow action from Subscriber accounts.
Detection Strategies
- Monitor web server access logs for POST requests to wp-admin/admin-ajax.php containing the yellow_message_dontshow action parameter.
- Audit the wp_options table for unexpected modifications, focusing on security-relevant keys such as users_can_register, default_role, and siteurl.
- Alert on creation of new user accounts immediately following requests to the vulnerable endpoint.
Monitoring Recommendations
- Enable WordPress audit logging to capture option changes and the originating user.
- Track plugin version inventory across WordPress fleets and flag any host running Page View Count 2.8.0 through 2.8.4.
- Forward webserver and WordPress audit logs to a centralized SIEM for correlation with authentication events.
How to Mitigate CVE-2025-2816
Immediate Actions Required
- Update the Page View Count plugin to a version newer than 2.8.4 that includes the capability check fix.
- Audit existing Subscriber and low-privilege accounts and remove any that are not legitimate.
- Disable open user registration if it is not required by the site.
- Review the wp_options table and restore any options that were altered to the value 1.
Patch Information
The vendor addressed the issue in the plugin source. Refer to the WordPress Changeset Log for the specific code changes that introduced the capability check on yellow_message_dontshow().
Workarounds
- Temporarily deactivate the Page View Count plugin until the patched version is installed.
- Restrict access to wp-admin/admin-ajax.php from untrusted IP ranges where feasible.
- Set users_can_register to 0 in the WordPress general settings to prevent automatic Subscriber account creation.
# Confirm plugin version and update via WP-CLI
wp plugin get page-views-count --field=version
wp plugin update page-views-count
# Disable open registration as a defense-in-depth measure
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
