CVE-2025-23515 MEDIUM

CVE-2025-23515: WordPress ts-tree plugin <= 0.1.1 - Arbitrary Content Deletion vulnerability

Vendor Tsecher

Product ts-tree

Weakness CWE-862 · Missing authorization

Published March 3, 2025

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Missing Authorization vulnerability in tsecher ts-tree ts-tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ts-tree: from n/a through <= 0.1.1.

Explanation of Vulnerability in Simple Terms

02Summary

ts-tree versions 0.1.1 and earlier lack proper authorization checks, allowing authenticated users to trigger a denial-of-service condition. An attacker with low-level access can exhaust server resources and make the application unavailable. No code execution or data breach is possible through this vulnerability.

What an attacker can do

03Attacker Capabilities

Crash or disable the application by exhausting server resources.

Potential impact on your site

04Site Impact

Site becomes unavailable to legitimate users until the application is restarted or the attacker's session is terminated.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges.

Key dates

06Disclosure timeline

March 3, 2025 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-23515 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities