CVE-2025-5814 is a missing authorization vulnerability (CWE-862) in the switcorp Profiler – What Slowing Down Your WP WordPress plugin, affecting all versions up to 1.0.0. The vulnerability arises because the wpsd_plugin_control() function does not perform a capability check, enabling unauthenticated attackers to reactivate plugins that were previously deactivated by accessing the Profiler page. This unauthorized modification of plugin states could lead to unintended plugin activation without user consent. The vulnerability has a CVSS v3.1 base score of 5.3 (medium severity), with an attack vector of network, low attack complexity, no privileges required, and no user interaction needed. No patch or official fix is currently documented.

The vulnerability allows unauthenticated attackers to modify the state of WordPress plugins by reactivating plugins that were previously deactivated. This could potentially lead to the execution of plugins that the site administrator intended to keep disabled, possibly resulting in security or operational issues depending on the reactivated plugins. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the Profiler page or disabling the plugin if it is not essential. Monitoring for unexpected plugin state changes may help detect exploitation attempts. Avoid granting unnecessary permissions to unauthenticated users. Follow vendor communications for updates on patches or official mitigations.