What is the CVSS score of CVE-2025-11497?

CVE-2025-11497 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-11497

MEDIUM

Improper Input Validation (CWE-20)

2025-10-25 security@wordfence.com

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Oct 25, 2025 - 07:15 nvd

MEDIUM 4.3

DescriptionCVE.org

The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to missing or incorrect nonce validation on the aDBc_prepare_elements_to_clean() function. This makes it possible for unauthenticated attackers to alter the keep last setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2025-64357 is a duplicate of this issue.

AnalysisAI

Cross-Site Request Forgery in Advanced Database Cleaner plugin for WordPress (versions up to 3.1.6) allows unauthenticated attackers to modify the keep last setting through forged requests targeting the aDBc_prepare_elements_to_clean() function, provided a site administrator can be socially engineered into clicking a malicious link. The vulnerability stems from missing or incorrect nonce validation. While the CVSS score is moderate (4.3), exploitation requires user interaction (UI:R) and results in limited integrity impact (data modification rather than code execution or availability compromise). No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The Advanced Database Cleaner plugin for WordPress implements database cleanup and maintenance functionality. The vulnerability resides in the aDBc_prepare_elements_to_clean() function, which processes user requests to configure which database elements should be retained or deleted. The root cause is classified as CWE-20 (Improper Input Validation), specifically the absence of proper Cross-Site Request Forgery (CSRF) protection tokens (nonces) that WordPress provides via its wp_verify_nonce() function. WordPress nonces are security tokens that verify requests originate from legitimate users within the same session, preventing attackers from forging state-changing requests from external sites. The affected product is a plugin that extends WordPress core functionality, making it accessible to any site with the plugin installed and activated. The vulnerability affects the plugin's administrative settings modification interface.

Affected ProductsAI

The Advanced Database Cleaner plugin for WordPress is affected in all versions up to and including 3.1.6. This is a WordPress plugin distributed via the official WordPress plugin repository (plugins.trac.wordpress.org). The plugin provides database maintenance and cleanup functionality for WordPress installations. Affected administrators can identify the plugin by its slug 'advanced-database-cleaner' in the WordPress plugins directory. Additional detail is available via the WordPress plugin changeset referenced in the Wordfence vulnerability database (ID: 4f4635ac-2ce6-4135-8d2b-d03b42860f05).

RemediationAI

Patch available: Update Advanced Database Cleaner to version 3.1.7 or later, which includes corrected nonce validation in the aDBc_prepare_elements_to_clean() function. Site administrators can apply this fix immediately via the WordPress dashboard (Plugins > Installed Plugins, locate Advanced Database Cleaner, and click Update if available) or manually download the patched version from the official WordPress plugin repository. No interim workarounds are documented; the primary mitigation is prompt patching. Verify the update is complete and the plugin is reactivated before considering the vulnerability closed. For detailed remediation guidance and technical details, refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4635ac-2ce6-4135-8d2b-d03b42860f05 and the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/.