CVE-2025-11894

Shelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update

Published Nov 11, 2025 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to modify several of the plugin's settings like the ServerKey and LicenseKey.

Analysis

Technical impact

The Shelf Planner plugin for WordPress contains a missing capability check on several REST API endpoints, allowing any unauthenticated user to alter critical settings such as ServerKey and LicenseKey, which can lead to unauthorized configuration changes and potential compromise of the plugin's integrity.

Affected Systems

Affected systems include all installations of the Shelf Planner Inventory Management for WooCommerce plugin up to and including version 2.8.1, regardless of the WordPress site or hosting environment.

Risk and Exploitability

The vulnerability has a CVSS score of 5.3 and an EPSS score of < 1%, indicating moderate severity and low exploitation probability; it is not included in the CISA KEV catalog. Attackers could exploit the flaw remotely via the plugin's REST API without authentication, making mitigation via updating the plugin the primary recommendation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

shelfplanner

Shelf Planner Inventory Management for WooCommerce

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.8.1

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Shelf Planner to a version newer than 2.8.1.
If an update is not immediately available, restrict access to the plugin's REST endpoints to authenticated users only.
Review and enforce capability checks on all REST API endpoints within the plugin.
Monitor security logs for unexpected changes to plugin settings.

Generated by OpenCVE AI on April 22, 2026 at 21:16 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.292% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://wordpress.org/plugins/shelf-planner/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/107031b3-5071-490a-a8f7-060212b1724c?source=cve

History

Apr 8, 2026 5:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://wordpress.org/plugins/shelf-planner/

Apr 8, 2026 5:00 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description	The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to modify several of the plugin's settings like the ServerKey and LicenseKey.	The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to modify several of the plugin's settings like the ServerKey and LicenseKey.
Title	Shelf Planner <= 2.7.0 - Missing Authorization to Unauthenticated Settings Update	Shelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update
References		https://wordpress.org/plugins/shelf-planner/#developers

Nov 12, 2025 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 12, 2025 1:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Nov 11, 2025 3:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to modify several of the plugin's settings like the ServerKey and LicenseKey.
Title		Shelf Planner <= 2.7.0 - Missing Authorization to Unauthenticated Settings Update
Weaknesses		CWE-862
References		https://wordpress.org/plugins/shelf-planner/ https://www.wordfence.com/threat-intel/vulnerabilities/id/107031b3-5071-490a-a8f7-060212b1724c?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`