---
id: CVE-2025-8574
title: >-
  Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table
  Deletion
summary: >-
  The Database Cleaner plugin for WordPress is vulnerable to arbitrary table
  deletion in all versions up to, and including, 1.4.7. This is due to a lack of
  restriction on database tables that can be deleted. This makes it possible for
  auth…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-284
vendor: tigroumeow
product: 'Database Cleaner: Cleanup, Optimization & Repair'
affected:
  - database_cleaner_cleanup_optimization_repair <= 1.4.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T17:32:21.082400Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:08:59.619Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-8574'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/22d6aa93-b265-41eb-9be9-cd066292f2ea?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/database-cleaner/trunk/classes/rest.php#L765
  - url: 'https://plugins.trac.wordpress.org/changeset/3774510/'
tags:
  - cve.org
epss: 0.00366
epssPercentile: 0.30638
ingestedAt: '2026-11-05T16:24:31.317Z'
---

## Overview

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete core WordPress tables.

## Affected

- `database_cleaner_cleanup_optimization_repair <= 1.4.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.