Database Cleaner CVE-2025-8574

The Database Cleaner plugin (<=1.4.7) must be installed and active, and the attacker must already hold an Administrator-level account to reach the plugin's table-deletion REST endpoint (rest.php), which fails to restrict deletion to the plugin's own/non-core tables. The dominant limiting factor is PR:H - authenticated Administrator privileges are mandatory, so this is not remotely exploitable by unauthenticated users; realistic risk is confined to sites with multiple, delegated, or potentially compromised admin accounts rather than default single-admin deployments.

The signals point to a real but tightly bounded issue rather than a top-tier emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H, base 8.7) is driven high by the scope change and dual integrity/availability impact, but PR:H is the decisive limiter: exploitation requires an already-authenticated Administrator-level account, which by CVSS definition means the actor is authenticated (PR:H). No EPSS score is provided and the CVE is not in CISA KEV, so there is no public-exploitation signal; the exploitation status is 'no public exploit identified at time of analysis' (the trac references are the vulnerable source line and the fix changeset, not exploit code). SSVC/decision framing is vuln.today 'this_week', consistent with a serious-but-not-act_now item. The practical tension is that an Administrator can already damage a WordPress site through legitimate means, so the marginal risk this flaw adds is that a cleanup feature lets a privileged (or privilege-abusing / compromised-admin) user destroy core tables beyond the plugin's intended scope - meaningful for multi-admin or delegated-admin sites, low for single-trusted-admin installs. EPSS and KEV data are absent, not conflicting.

An attacker who holds or has compromised an Administrator-level WordPress account invokes the Database Cleaner plugin's table-deletion REST endpoint and, because the plugin does not restrict which tables may be removed, deletes core WordPress tables (e.g. wp_users, wp_options, wp_posts), taking the site down and destroying data. No public working exploit is identified; the Wordfence advisory and the trac source/changeset links document the flaw and its fix, not a weaponized PoC.