What’s Vulnerable › Vulnerabilities

CVE-2025-5814: Profiler – What Slowing Down Your WP <= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State Restoration

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-07 · updated 2026-06-17
• Weakness: CWE-862

Description

The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsd_plugin_control() function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate previously deactivated plugins after accessing the "Profiler" page.

Affected products

• switcorp Profiler – What Slowing Down Your WP: through 1.0.0

References

• https://plugins.trac.wordpress.org/browser/profiler-what-slowing-down/trunk/actions.php#L31
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9213db60-c0c1-44a9-9b8c-621029c3a08f?source=cve

Get alerted when CVE-2025-5814 or the next vulnerability affects your stack