CVE-2025-10212

SiteAlert (Formerly WP Health) <= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information Exposure

Published Oct 3, 2025 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to view the site health information, including a list of installed and outdated plugins, PHP and Database version, etc.

Analysis

Technical impact

The SiteAlert (Formerly WP Health) plugin for WordPress has a missing capability check on several AJAX functions in all versions up to and including 1.9.8. This weakness allows anyone on the internet who can send unauthenticated HTTP requests to these endpoints to view detailed site health information, such as the list of installed plugins, which plugins are outdated, the PHP version, and the database version. The disclosure of this information can be leveraged in subsequent targeted attacks, as it provides a ready inventory of potential attack vectors and system configuration details.

Affected Systems

This vulnerability affects the SiteAlert (Formerly WP Health) WordPress plugin for all releases up to and including version 1.9.8. Users running any of these versions on a WordPress installation are potentially exposed unless the plugin is upgraded or protected by external means.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate overall impact, and the EPSS score of less than 1% reflects a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can reach the vulnerable AJAX endpoints via unauthenticated HTTP requests, thereby reading the site health data without needing any credentials.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

sitealert

SiteAlert (Formerly WP Health)

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.9.8

No data.

Vendor	Product	Versions
Sitealert	Sitealert	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update SiteAlert to a version newer than 1.9.8 to apply the missing capability check.
If an immediate update is not possible, block unauthenticated access to the plugin’s AJAX endpoints by configuring a web application firewall or adding .htaccess rules that restrict access to authenticated users.
If the plugin is not essential, consider disabling or removing it entirely to eliminate the exposure.

Generated by OpenCVE AI on April 27, 2026 at 23:45 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-32288	The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to view the site health information, including a list of installed and outdated plugins, PHP and Database version, etc.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.383% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L129
https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L144
https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L159
https://www.wordfence.com/threat-intel/vulnerabilities/id/0696b9e2-3685-4bea-8b1f-74e2dc927532?source=cve

History

Oct 6, 2025 2:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Sitealert Sitealert sitealert Wordpress Wordpress wordpress
Vendors & Products		Sitealert Sitealert sitealert Wordpress Wordpress wordpress

Oct 3, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 3, 2025 11:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to view the site health information, including a list of installed and outdated plugins, PHP and Database version, etc.
Title		SiteAlert (Formerly WP Health) <= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information Exposure
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L129 https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L144 https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L159 https://www.wordfence.com/threat-intel/vulnerabilities/id/0696b9e2-3685-4bea-8b1f-74e2dc927532?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`