Description
The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.
Published: 2025-06-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized modification of plugin settings disabling bot logging
Action: Patch Immediately
AI Analysis

Impact

The Traffic Monitor plugin for WordPress contains a missing capability check in the tfcm_maybe_set_bot_flags() function. This flaw allows an unauthenticated user to alter plugin settings and disable bot logging, thereby compromising the integrity of the site’s monitoring capabilities. The weakness is an Authorization issue (CWE-862).

Affected Systems

WordPress sites that have installed the dmitriamartin Traffic Monitor plugin, any version up to and including 3.2.2.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves sending crafted HTTP requests to the plugin’s interface or accessing its administrative endpoints without authentication, which triggers the missing capability check.

Generated by OpenCVE AI on April 22, 2026 at 01:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Traffic Monitor plugin to the latest version that includes the missing capability check.
  • If an upgrade cannot be performed immediately, restrict public access to the WordPress admin area using IP whitelisting or two‑factor authentication to limit the ability of unauthenticated users to interact with the plugin’s endpoints.
  • Monitor WordPress logs for any unauthorized changes to Traffic Monitor settings so that potential exploitation can be detected quickly.

Generated by OpenCVE AI on April 22, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-18243 The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.
History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00086}

 epss

{'score': 0.00029}

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00059}

 epss

{'score': 0.00086}

Fri, 13 Jun 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 13 Jun 2025 04:00:00 +0000

Type Values Removed Values Added
Description The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.
Title Traffic Monitor <= 3.2.2 - Missing Authorization to Unauthenticated Settings Update
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:53:05.800Z

Reserved: 2025-06-06T16:20:03.177Z

Link: CVE-2025-5815

cve-icon Vulnrichment

Updated: 2025-06-13T19:06:39.564Z

cve-icon NVD

Status : Deferred

Published: 2025-06-13T04:15:33.020

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-5815

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T01:30:05Z

Weaknesses