Maspik – Spam Blacklist, CVE-2025-9979
- CVE, Research URL
- Home page URL
- Application
- Published on
- Sep 10, 2025
- Research Description
- The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks on the Maspik_spamlog_download_csv function. This makes it possible for authenticated attackers, with subscriber-level access and above, to export and download the spam log database containing blocked submission attempts, which may include misclassified but legitimate submissions with sensitive data.
- Affected versions
-
max 2.5.7.
- Status
-
vulnerable