Database Cleaner
Monthly
Arbitrary deletion of WordPress core database tables is possible through the Database Cleaner plugin in all versions up to and including 1.4.7, because the plugin's table-deletion REST endpoint does not restrict which tables may be targeted. Rated CVSS 8.7 with a scope change (C:N/I:H/A:H), the flaw nonetheless requires the attacker to already hold Administrator-level credentials, so realistic risk is confined to sites with multiple, delegated, or potentially compromised admin accounts rather than default single-admin deployments. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; priority is this_week rather than emergency.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jordy Meow Database Cleaner allows Relative Path Traversal.0.5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.9.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arbitrary deletion of WordPress core database tables is possible through the Database Cleaner plugin in all versions up to and including 1.4.7, because the plugin's table-deletion REST endpoint does not restrict which tables may be targeted. Rated CVSS 8.7 with a scope change (C:N/I:H/A:H), the flaw nonetheless requires the attacker to already hold Administrator-level credentials, so realistic risk is confined to sites with multiple, delegated, or potentially compromised admin accounts rather than default single-admin deployments. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; priority is this_week rather than emergency.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jordy Meow Database Cleaner allows Relative Path Traversal.0.5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.9.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.