CVE-2025-8147 MEDIUM

CVE-2025-8147: LWSCache <= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function

Vendor Aurelienlws
Product LWSCache
Weakness CWE-285
Published August 29, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscache_activatePlugin() function in all versions up to, and including, 2.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate arbitrary whitelisted LWS plugins.

Explanation of Vulnerability in Simple Terms

02Summary

LWSCache versions 2.8.5 and earlier contain an improper access control vulnerability that allows authenticated users to modify data they should not have permission to change. The vulnerability requires a valid user account and network access but does not require user interaction. Integrity of cached data may be compromised.

What an attacker can do

03Attacker Capabilities

Modify cached data or settings without proper authorization.

Potential impact on your site

04Site Impact

Authenticated users could alter cached content or configuration, potentially affecting site functionality or data integrity.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account on the site.

Key dates

06Disclosure timeline

August 29, 2025 CVE published
April 8, 2026 Record updated