CVE-2025-9979

The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks on the Maspik_spamlog_download_csv function. This makes it possible for authenticated attackers, with subscriber-level access and above, to export and download the spam log database containing blocked submission attempts, which may include misclassified but legitimate submissions with sensitive data.

• CWE-862

• https://plugins.trac.wordpress.org/browser/contact-forms-anti-spam/trunk/includes/functions.php#L1482
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3357602%40contact-forms-anti-spam&new=3357602%40contact-forms-anti-spam&sfp_email=&sfph_mail=
• https://research.cleantalk.org/cve-2025-9879/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee68705-cbb3-44b8-8223-4cecd678bcab?source=cve

Published

Sep 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9973Due to not validating the organization context when executin…7.2
• CVE-2025-9974The unified WEBUI application of the ONT/Beacon device conta…8
• CVE-2025-9975The WP Scraper plugin for WordPress is vulnerable to Server-…6.8
• CVE-2025-9976An OS Command Injection vulnerability affecting Station Laun…9
• CVE-2025-9977Value provided in one of POST parameters sent during the pro…5.3
• CVE-2025-9978The Jeg Kit for Elementor WordPress plugin before 2.7.0 doe…6.8
• CVE-2025-9980QuickCMS is vulnerable to multiple Stored XSS in page editor…4.8
• CVE-2025-9981QuickCMS is vulnerable to multiple Stored XSS in slider edit…4.8
• CVE-2025-9982A vulnerability exists in QuickCMS version 6.8 where sensiti…7.5
• CVE-2025-9983GALAYOU G2 cameras stream video output via RTSP streams. By …7.1
• CVE-2025-9984The Featured Image from URL (FIFU) plugin for WordPress is v…5.3
• CVE-2025-9985The Featured Image from URL (FIFU) plugin for WordPress is v…5.3