CVE-2025-8147: 
WordPress vulnerability analysis and mitigation

CVE-2025-8147 is an improper authorization vulnerability in the LWSCache plugin for WordPress, classified under CWE-285. It allows authenticated attackers with Subscriber-level access or above to activate arbitrary whitelisted LWS plugins by exploiting the lwscache_activatePlugin() function, which lacks proper authorization checks. All versions up to and including 2.8.5 are affected. The vulnerability was published on August 29, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is improper authorization (CWE-285) in the lwscache_activatePlugin() function within the LWSCache WordPress plugin. The function does not enforce adequate capability checks before allowing plugin activation, meaning any authenticated user — even those with minimal privileges such as Subscriber — can invoke it over the network. An attacker sends a crafted authenticated HTTP request targeting this function to activate any plugin present on the LWS whitelist, potentially enabling additional attack surface. The vulnerable code is visible in the plugin's source at version 2.8.5 (Wordfence, WordPress Trac).

Successful exploitation allows low-privileged authenticated users to activate whitelisted LWS plugins without authorization, resulting in unauthorized modification of the WordPress site's configuration and functionality. The primary impact is on integrity (low), with no direct confidentiality or availability impact. Depending on which whitelisted plugins are activated, secondary risks may include expanded attack surface, unintended feature enablement, or facilitation of further exploitation (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-8147 as of the available data. The vulnerability requires authentication at the Subscriber level or above, which limits opportunistic exploitation but remains accessible to any registered user on affected WordPress sites. The EPSS score is approximately 0.026% (0.000260), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the LWSCache plugin at version 2.8.5 or earlier, using tools like WPScan or manual inspection of plugin metadata.
2. Obtain Subscriber-level access: Register as a user on the target WordPress site (if open registration is enabled) or use existing low-privilege credentials.
3. Identify target plugin: Determine which LWS whitelisted plugins are available but inactive on the target site.
4. Craft malicious request: As an authenticated Subscriber, send an HTTP POST request invoking the lwscache_activatePlugin() function with the desired plugin slug as a parameter, bypassing the missing authorization check.
5. Activate plugin: The function executes without proper capability verification, activating the chosen whitelisted LWS plugin on the site (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to admin-ajax.php or REST API endpoints invoking lwscache_activatePlugin from low-privilege user accounts.
• WordPress Activity: Unexpected activation of LWS whitelisted plugins recorded in WordPress site activity logs or plugin management history, particularly initiated by Subscriber-level accounts.
• File System: Changes to the active plugins list in the WordPress database (wp_options table, active_plugins key) reflecting newly activated LWS plugins not authorized by an administrator.

Users should update the LWSCache plugin to version 2.8.6 or later, which addresses the missing authorization check in lwscache_activatePlugin() (WordPress Trac Changeset). As an interim measure, site administrators can restrict user registration to prevent untrusted Subscriber-level accounts, or temporarily deactivate the LWSCache plugin until patching is feasible. Monitoring plugin activation events for unexpected changes is also recommended.

Wordfence, the CVE assigner, disclosed the vulnerability as part of their weekly WordPress vulnerability report for August 25–31, 2025, noting it as a medium-severity issue (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.