CVE-2025-62966

The GoCache CDN plugin for WordPress versions up to and including 1.3.6 contains a missing authorization vulnerability, which allows exploitation of incorrectly configured access control security levels [1]. This issue arises from insufficient capability checks on certain plugin functions, making them accessible to users without proper privileges.

An attacker with low-level or no authentication can exploit this flaw to perform actions intended for higher-privileged users, such as modifying CDN settings or other sensitive configurations [1]. The attack surface is the WordPress admin interface, where the vulnerable functions are invoked without proper authorization.

Successful exploitation could lead to unauthorized changes to the site's CDN configuration, potentially affecting performance or security. This vulnerability is known to be used in mass-exploit campaigns targeting thousands of websites, regardless of their size or popularity [1].

As mitigation, users should update the plugin to a patched version when it becomes available. Immediate action is recommended, and if updating is not possible, users should seek assistance from their hosting provider or web developer [1].