CVE-2025-7821 — WC Plus <= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation
The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswc_logo_favicon_logo_base' AJAX action in all v…
Published: 2025-08-23 · CVSS: 5.3 · CVSS 3.1
The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswc_logo_favicon_logo_base' AJAX action in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update the site's favicon logo base.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7