CVE-2025-5811: Listly WordPress Auth Bypass Vulnerability

CVE-2025-5811 Overview

CVE-2025-5811 affects the Listly: Listicles For WordPress plugin in all versions up to and including 2.7. The vulnerability stems from a missing capability check on the Init() function, classified as [CWE-862] Missing Authorization. Unauthenticated attackers can send requests that delete arbitrary transient values on the WordPress site. Transients store cached data in WordPress, and their unauthorized removal can force cache regeneration, disrupt plugin functionality, and impact site performance. The flaw requires no authentication or user interaction and is exploitable over the network.

Critical Impact
Unauthenticated attackers can delete arbitrary WordPress transient values, causing integrity impact to cached data on affected sites.

Affected Products

Listly: Listicles For WordPress plugin
All versions up to and including 2.7
WordPress sites with the plugin installed and active

Discovery Timeline

2025-07-18 - CVE-2025-5811 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5811

Vulnerability Analysis

The Listly plugin exposes an Init() function that performs sensitive state-changing operations without verifying the caller's capabilities or authentication status. WordPress security guidelines require that any function modifying site data check user capabilities using current_user_can() and validate nonces on state-changing requests. The Init() function omits these checks, allowing any unauthenticated visitor to invoke the deletion logic.

The affected code path handles WordPress transients, which are time-limited cached values stored in the database or object cache. When an attacker triggers the vulnerable function, the plugin invokes transient deletion routines against attacker-supplied keys. This breaks caching contracts that other plugins and themes may rely on for performance and stateful operations.

Root Cause

The root cause is a missing authorization check ([CWE-862]) in the Init() handler of listly.php. The function should validate that the requesting user holds an appropriate capability such as manage_options before proceeding. Instead, it processes requests from any source, including anonymous visitors. Refer to the WordPress Plugin Source Code for the specific implementation.

Attack Vector

Exploitation occurs over the network by sending an HTTP request to the WordPress endpoint that triggers the Init() function. No credentials, session tokens, or user interaction are required. The attacker supplies transient keys targeted for deletion, either from known plugin caches or through enumeration. Repeated invocation can systematically clear transient storage, degrading site performance and potentially disrupting workflows that depend on cached data. Full technical analysis is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-5811

Indicators of Compromise

Unexpected deletion of transient rows from the wp_options table where option_name starts with _transient_ or _transient_timeout_
HTTP requests from unauthenticated sources targeting Listly plugin endpoints
Increased database write activity correlated with transient regeneration cycles
Site performance degradation from repeated cache invalidation

Detection Strategies

Audit WordPress access logs for anonymous POST or GET requests invoking the Init() handler in listly.php
Monitor the wp_options table for anomalous DELETE operations against transient keys
Deploy a Web Application Firewall (WAF) rule to flag requests to Listly plugin URLs originating from unauthenticated sources
Enable WordPress debug logging to capture calls to delete_transient() and correlate with request origins

Monitoring Recommendations

Track the plugin version present on WordPress deployments and alert on any host still running Listly 2.7 or earlier
Ingest WordPress and WAF logs into a centralized SIEM for correlation of unauthenticated plugin access patterns
Establish baseline metrics for transient cache size and deletion rate to detect deviations

How to Mitigate CVE-2025-5811

Immediate Actions Required

Update the Listly: Listicles For WordPress plugin to a version above 2.7 as soon as a patched release becomes available
Deactivate and remove the plugin if a patch is not available and the functionality is not required
Restrict access to WordPress administrative and plugin endpoints via WAF or IP allowlisting where feasible
Review WordPress logs for evidence of prior exploitation attempts against the vulnerable function

Patch Information

Consult the WordPress Plugin Listing for the latest available version of the Listly plugin. Administrators should verify that any installed version is later than 2.7 before considering the site remediated. Vendor-supplied patch details are tracked in the Wordfence Vulnerability Report.

Workarounds

Disable the Listly plugin until a fixed version is deployed
Deploy WAF rules that block unauthenticated requests to plugin endpoints handling state-changing actions
Apply a custom must-use plugin that wraps the vulnerable function with a current_user_can() capability check as a temporary hardening measure

bash

# Example WP-CLI commands to inventory and disable the vulnerable plugin
wp plugin list --name=listly --fields=name,status,version
wp plugin deactivate listly
wp plugin delete listly