CVE-2025-1481: 
WordPress vulnerability analysis and mitigation

The Shortcode Cleaner Lite plugin for WordPress contains a vulnerability (CVE-2025-1481) discovered on March 7, 2025. The vulnerability affects all versions up to and including 1.0.9, stemming from a missing capability check in the download_backup() function. This security flaw allows authenticated users with Subscriber-level access or higher to access and export arbitrary options without proper authorization (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) by Wordfence and 4.3 (Medium) by NIST NVD. The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and required low privileges. The weakness is categorized as CWE-862 (Missing Authorization) (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to export arbitrary options from the WordPress installation. This unauthorized access to data could potentially expose sensitive configuration settings and other critical information stored in the WordPress options table (NVD).

The plugin has been temporarily closed as of March 6, 2025, pending a full security review. Users are advised to remove or disable the plugin until a patched version is released (WordPress Plugin).