{"id":"CVE-2025-5815","aliases":["EUVD-2025-18243","GHSA-pc3q-9mpw-2wjf"],"status":"published","title":"Traffic Monitor \u003c= 3.2.2 - Missing Authorization to Unauthenticated Settings Update","description":"The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00481,"percentile":0.41803,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-862"],"published":"2025-06-13T03:41:44Z","modified":"2026-06-17T09:48:48Z","exploits":[{"source":"pocgithub","id":"RootHarpy/CVE-2025-5815-Nuclei-Template","title":"RootHarpy/CVE-2025-5815-Nuclei-Template","date":"2025-06-13","url":"https://github.com/RootHarpy/CVE-2025-5815-Nuclei-Template"}],"products":[{"vendor":"dmitriamartin","product":"traffic monitor"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/538669c7-3237-4059-85dc-4f4af1ff5a19?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/traffic-monitor/trunk/traffic-monitor.php#L74"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3309996%40traffic-monitor\u0026new=3309996%40traffic-monitor\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5815"},{"url":"https://github.com/advisories/GHSA-pc3q-9mpw-2wjf"}],"sources":{"cve":[{"id":"CVE-2025-5815","title":"Traffic Monitor \u003c= 3.2.2 - Missing Authorization to Unauthenticated Settings Update","description":"The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.","status":"published","published":"2025-06-13T03:41:44.276Z","modified":"2026-04-08T16:53:05.8Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:30.302289Z"}],"euvd":[{"id":"EUVD-2025-18243","description":"The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.","status":"published","published":"2025-06-13T03:41:44Z","modified":"2026-04-08T16:53:05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:58.604017Z"}],"ghsa":[{"id":"GHSA-pc3q-9mpw-2wjf","title":"The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due...","description":"The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.","status":"published","published":"2025-06-13T06:30:26Z","modified":"2025-06-13T06:30:32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:02:42.831943Z"}],"nvd":[{"id":"CVE-2025-5815","description":"The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.","status":"published","published":"2025-06-13T04:15:33.02Z","modified":"2026-06-17T09:48:48.11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:11.789448Z"}]}}