CVE-2025-11894
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to modify several of the plugin's settings like the ServerKey and LicenseKey.
Risk Assessment
The risk is the possibility of unauthorized changes to critical plugin settings, which could lead to security breaches or malfunction.
Recommendation
It is recommended to update the plugin to a version newer than 2.8.1 and check for any unauthorized changes to settings.
Other vulnerabilities in Shelf Planner
Original NVD description (English source)
The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to modify several of the plugin's settings like the ServerKey and LicenseKey.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS