CVE-2025-10706
|
| |
|
|
Software afectado |
WORDPRESS |
|
|
|
The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Framework plugin. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2025-10706 |
