CVE-2025-11497
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Description
The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to missing or incorrect nonce validation on the aDBc_prepare_elements_to_clean() function. This makes it possible for unauthenticated attackers to alter the keep last setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2025-64357 is a duplicate of this issue.
Analysis
Cross-Site Request Forgery in Advanced Database Cleaner plugin for WordPress (versions up to 3.1.6) allows unauthenticated attackers to modify the keep last setting through forged requests targeting the aDBc_prepare_elements_to_clean() function, provided a site administrator can be socially engineered into clicking a malicious link. The vulnerability stems from missing or incorrect nonce validation. While the CVSS score is moderate (4.3), exploitation requires user interaction (UI:R) and results in limited integrity impact (data modification rather than code execution or availability compromise). No public exploit code or active exploitation has been confirmed at time of analysis.
Technical Context
The Advanced Database Cleaner plugin for WordPress implements database cleanup and maintenance functionality. The vulnerability resides in the aDBc_prepare_elements_to_clean() function, which processes user requests to configure which database elements should be retained or deleted. The root cause is classified as CWE-20 (Improper Input Validation), specifically the absence of proper Cross-Site Request Forgery (CSRF) protection tokens (nonces) that WordPress provides via its wp_verify_nonce() function. WordPress nonces are security tokens that verify requests originate from legitimate users within the same session, preventing attackers from forging state-changing requests from external sites. The affected product is a plugin that extends WordPress core functionality, making it accessible to any site with the plugin installed and activated. The vulnerability affects the plugin's administrative settings modification interface.
Affected Products
The Advanced Database Cleaner plugin for WordPress is affected in all versions up to and including 3.1.6. This is a WordPress plugin distributed via the official WordPress plugin repository (plugins.trac.wordpress.org). The plugin provides database maintenance and cleanup functionality for WordPress installations. Affected administrators can identify the plugin by its slug 'advanced-database-cleaner' in the WordPress plugins directory. Additional detail is available via the WordPress plugin changeset referenced in the Wordfence vulnerability database (ID: 4f4635ac-2ce6-4135-8d2b-d03b42860f05).
Remediation
Patch available: Update Advanced Database Cleaner to version 3.1.7 or later, which includes corrected nonce validation in the aDBc_prepare_elements_to_clean() function. Site administrators can apply this fix immediately via the WordPress dashboard (Plugins > Installed Plugins, locate Advanced Database Cleaner, and click Update if available) or manually download the patched version from the official WordPress plugin repository. No interim workarounds are documented; the primary mitigation is prompt patching. Verify the update is complete and the plugin is reactivated before considering the vulnerability closed. For detailed remediation guidance and technical details, refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4635ac-2ce6-4135-8d2b-d03b42860f05 and the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today