CVE-2025-5815 is a missing authorization vulnerability (CWE-862) in the Traffic Monitor WordPress plugin by dmitriamartin. The tfcm_maybe_set_bot_flags() function lacks a capability check, enabling unauthenticated users to disable bot logging functionality. This vulnerability affects all versions up to 3.2.2 and could allow unauthorized modification of plugin data. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is currently available.

An unauthenticated attacker can disable bot logging in the Traffic Monitor plugin, potentially impairing the ability to detect or monitor bot activity on the affected WordPress site. There is no direct confidentiality or availability impact reported. The integrity of the plugin's logging data can be compromised, which may affect security monitoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's functionality through other means such as web application firewalls or limiting access to administrative endpoints. Monitor for updates from the vendor and apply patches promptly once available.