CVE-2025-62964
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin for WordPress in versions up to and including 1.3.6 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables performing operations without the required privileges.
Risk Assessment
An unauthorized user could gain access to functions or data they should not have access to, potentially resulting in content modification or information disclosure. The risk applies to all installations of the MDTF plugin version <= 1.3.6.
Recommendation
Update the MDTF plugin to the latest version (above 1.3.6). If no update is available, consider disabling the plugin.
Other vulnerabilities in MDTF
See all- CVE-2026-54843Critical
There is an unauthenticated SQL injection vulnerability in MDTF versions <= 1.3.7.
- CVE-2025-62069Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter. This issue affects MDTF: from n/a through <= 1.3.3.8.
- CVE-2025-49907Medium
The MDTF plugin up to version 1.3.3.9 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to functionality.
Original NVD description (English source)
Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS