CVE-2025-5814: WordPress Profiler Auth Bypass Vulnerability

CVE-2025-5814 Overview

CVE-2025-5814 affects the Profiler – What Slowing Down Your WP plugin for WordPress. The plugin fails to enforce a capability check on the wpsd_plugin_control() function in all versions up to and including 1.0.0. Unauthenticated attackers can reactivate previously deactivated plugins after accessing the Profiler page. The weakness is categorized as Missing Authorization [CWE-862].

Critical Impact
Unauthenticated attackers can reactivate deactivated WordPress plugins, potentially restoring vulnerable or intentionally disabled components on affected sites.

Affected Products

WordPress plugin: Profiler – What Slowing Down Your WP
Affected versions: all releases up to and including 1.0.0
Impacted deployments: any WordPress site running the vulnerable plugin

Discovery Timeline

2025-06-07 - CVE-2025-5814 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5814

Vulnerability Analysis

The Profiler plugin exposes a plugin control handler through the wpsd_plugin_control() function, defined in actions.php. The handler is intended to toggle plugin activation state from within the plugin's administrative Profiler page. The function does not verify the caller's capabilities before performing state-changing operations. Attackers who reach the Profiler page endpoint can invoke the handler without authentication and reactivate plugins that a site administrator previously deactivated. The result is an integrity impact on the site configuration, though confidentiality and availability are not directly affected.

Root Cause

The root cause is a missing authorization check [CWE-862] inside wpsd_plugin_control(). The function omits both a current_user_can() capability check and a nonce verification step. Because WordPress AJAX and admin-post hooks execute for any requester that can reach them, the absence of these controls collapses the trust boundary between administrators and unauthenticated visitors.

Attack Vector

Exploitation is remote and does not require authentication or user interaction. An attacker sends a crafted HTTP request that triggers the wpsd_plugin_control() action on a vulnerable site. The handler then activates the specified plugin. This can be abused to re-enable a plugin that was deactivated because it contained a known vulnerability, restoring an exploitable attack surface. Technical details are documented in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-5814

Indicators of Compromise

Unexpected reactivation of previously deactivated WordPress plugins recorded in the wp_optionsactive_plugins entry.
HTTP requests targeting the Profiler plugin's action endpoint from unauthenticated sources.
Access log entries referencing wpsd_plugin_control or the Profiler admin page from external IP addresses.

Detection Strategies

Compare the current active_plugins list against a known-good baseline and alert on unexplained additions.
Inspect web server access logs for requests to admin-ajax.php or admin-post handlers referencing Profiler actions without an authenticated session cookie.
Enable WordPress audit logging to record plugin activation and deactivation events with the initiating user identity.

Monitoring Recommendations

Monitor filesystem and database changes to plugin state on WordPress hosts.
Alert on activation of plugins that security operations previously disabled due to known vulnerabilities.
Track outbound requests from the WordPress host after plugin state changes to detect follow-on exploitation.

How to Mitigate CVE-2025-5814

Immediate Actions Required

Update the Profiler – What Slowing Down Your WP plugin to a version later than 1.0.0 once the vendor publishes a patched release.
Deactivate and remove the plugin if a fixed version is not yet available.
Audit active_plugins and revert any unauthorized reactivations discovered during review.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Refer to the Wordfence Vulnerability Report for the latest remediation status and to the WordPress Plugin Code Review for the vulnerable code path.

Workarounds

Block external requests to the Profiler plugin's action endpoints at a Web Application Firewall (WAF) or reverse proxy.
Restrict access to wp-admin and admin-ajax.php by source IP where operationally feasible.
Remove the plugin's files from the WordPress installation until a fixed version is released.

bash

# Configuration example: block Profiler plugin action at nginx
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "wpsd_plugin_control") {
        return 403;
    }
}