Page View Count 2.8.0 - 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

Description

The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the yellow_message_dontshow() function in versions 2.8.0 to 2.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to one on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.

Scores

EPSS (exploitation in 30 days)

0.37% · top 69% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Weakness

• CWE-862 Missing Authorization (opens in a new tab)All about CWE-862 and its CVEs

Affected products

• a3rev · Page View Count

  • affected 2.8.0 – ≤ 2.8.4

References (2)

• https://www.wordfence.com/threat-intel/vulnerabilities/id/e6fb9558-06e5-4297-93df-ee9a6971f0ec?source=cve (opens in a new tab)
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3282975%40page-views-count&new=3282975%40page-views-count&sfp_email=&sfph_mail= (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-2816](https://trackcve.app/badge/CVE-2025-2816.svg)](https://trackcve.app/cve/CVE-2025-2816)

Record last updated 1 May 2025, 13:24 UTC.