CVE-2025-5815
Description
The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=3.2.2
Patches
Vulnerability mechanics
Root cause
"Missing capability check in tfcm_maybe_set_bot_flags() allows unauthenticated attackers to disable bot logging."
Attack vector
An unauthenticated attacker can send a crafted HTTP request to the WordPress site that triggers the `tfcm_maybe_set_bot_flags()` function. Because no authorization check (CWE-862) is performed, the attacker can set the `TFCM_SKIP_BOT_LOGGING` flag to `true`, which causes the plugin to skip logging all subsequent bot traffic. This allows malicious bot activity to go unrecorded in the plugin's logs, undermining the monitoring functionality.
Affected code
The vulnerability resides in the `tfcm_maybe_set_bot_flags()` function within the Traffic Monitor plugin (all versions up to 3.2.2). The function lacks a capability check, allowing unauthenticated attackers to disable bot logging. The plugin's main file `traffic-monitor.php` defines the global flags `TFCM_BOT_BLOCKING` and `TFCM_SKIP_BOT_LOGGING` that control bot-related behavior.
What the fix does
The advisory does not include a patch diff. The recommended remediation is to add a capability check (e.g., `current_user_can('manage_options')`) inside `tfcm_maybe_set_bot_flags()` before allowing the bot logging flags to be modified. Without this check, any unauthenticated visitor can toggle the bot logging state. The fix should ensure only authenticated administrators can alter these settings.
Preconditions
- networkThe attacker must be able to send HTTP requests to the WordPress site (no authentication required).
- configThe Traffic Monitor plugin must be installed and active (version ≤ 3.2.2).
Generated on Jun 19, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.