CVE-2025-47457: LocateAndFilter Auth Bypass Vulnerability

CVE-2025-47457 Overview

CVE-2025-47457 is a missing authorization vulnerability in the dgamoni LocateAndFilter WordPress plugin. The flaw affects all versions of locateandfilter up to and including 1.6.16. Unauthenticated attackers can access functionality that is not properly constrained by access control lists (ACLs). The issue is classified under CWE-862: Missing Authorization and stems from broken access control in plugin endpoints.

The vulnerability is exploitable over the network without authentication or user interaction. Successful exploitation results in low-impact confidentiality disclosure, with no direct impact to integrity or availability.

Critical Impact
Unauthenticated remote attackers can reach plugin functionality intended to be restricted, enabling low-impact information exposure on affected WordPress sites.

Affected Products

dgamoni LocateAndFilter WordPress plugin (locateandfilter)
All versions from n/a through 1.6.16
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-05-07 - CVE-2025-47457 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47457

Vulnerability Analysis

The LocateAndFilter plugin exposes functionality that should be gated by authorization checks. The plugin fails to verify whether the requesting user holds the required capability or role before executing the affected code paths. Because the check is missing rather than incorrectly implemented, any network-reachable client can invoke the functionality.

The result is a broken access control condition [CWE-862] that lets anonymous requests reach code paths intended for privileged users. According to the Patchstack Vulnerability Report, the flaw is a broken access control issue affecting versions up to 1.6.16.

The EPSS score for this issue is 0.29%, indicating a low probability of observed exploitation in the near term. No public proof-of-concept or exploit code is currently listed in Exploit-DB, and the vulnerability is not on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is the absence of an authorization check on one or more plugin handlers. WordPress plugins typically enforce access using current_user_can() capability checks or check_ajax_referer() nonce validation on AJAX and REST endpoints. When these checks are omitted, the endpoint honors requests from any caller, including unauthenticated visitors.

Attack Vector

An attacker sends crafted HTTP requests to the exposed plugin endpoint over the network. No credentials, tokens, or user interaction are required. Because the vulnerability is limited to low confidentiality impact, the practical outcome is unauthorized access to data or functionality that should be restricted, rather than site takeover or data modification.

The vulnerability manifests in the plugin's request-handling path where authorization enforcement is missing. See the Patchstack Vulnerability Report for further technical details.

Detection Methods for CVE-2025-47457

Indicators of Compromise

Unauthenticated HTTP requests to admin-ajax.php or REST routes registered by the LocateAndFilter plugin
Anomalous access patterns to plugin endpoints from unauthenticated sources or automated scanners
Web server logs showing repeated requests targeting locateandfilter action names or query parameters

Detection Strategies

Inventory WordPress installations and identify sites running locateandfilter version 1.6.16 or earlier
Review web access logs for requests to plugin-specific AJAX actions or REST endpoints without an authenticated session cookie
Correlate high-volume enumeration attempts against plugin endpoints with source IP reputation data

Monitoring Recommendations

Enable verbose logging on WordPress and forward logs to a centralized platform for correlation
Monitor for spikes in POST and GET traffic to /wp-admin/admin-ajax.php referencing LocateAndFilter actions
Alert on requests to plugin endpoints originating from IPs associated with vulnerability scanners

How to Mitigate CVE-2025-47457

Immediate Actions Required

Identify all WordPress sites using the LocateAndFilter plugin and confirm the installed version
Update the plugin to a fixed release once available from the vendor via the WordPress plugin repository
Restrict administrative and AJAX endpoints behind a Web Application Firewall (WAF) rule that requires authentication

Patch Information

As of the latest NVD update, the advisory identifies the issue as affecting versions up to and including 1.6.16. Site administrators should consult the Patchstack Vulnerability Report for the current fixed version and apply it as soon as it becomes available.

Workarounds

Deactivate and remove the LocateAndFilter plugin until a patched version is installed
Deploy WAF rules that block unauthenticated requests to the plugin's AJAX or REST endpoints
Apply least-privilege principles and audit which plugin actions are exposed to unauthenticated visitors

bash

# Example: block unauthenticated access to plugin endpoints via .htaccess
# Replace <plugin-action> with LocateAndFilter action names identified in logs
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{QUERY_STRING} action=<plugin-action> [NC]
  RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_ [NC]
  RewriteRule ^wp-admin/admin-ajax\.php$ - [F,L]
</IfModule>