WordPress Page View Count Plugin Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Page View Count plugin for WordPress, affecting versions 2.8.0 to 2.8.4. The issue arises from a missing capability check in the yellow_message_dontshow() function, allowing authenticated attackers with Subscriber-level access and above to unauthorizedly modify option values on the WordPress site. This exploitation can lead to errors that disrupt service for legitimate users or manipulate certain options, such as enabling user registration.

Impact

Exploitation of this vulnerability can cause errors that disrupt normal site operations, leading to a denial-of-service condition for legitimate users. Additionally, it can be used to manipulate WordPress options in a way that could disrupt site functionality or user management.

Remediation

Users are advised to update the Page View Count plugin to version 2.8.5 or a newer patched version.