PT-2026-20597 · WordPress · Shopire+1

Ky0Tofu · Publicado 2026-02-19 · Atualizado 2026-02-19 · CVE-2025-13091

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shopire theme for WordPress versions prior to 1.0.58

Description The Shopire theme for WordPress has an issue where data can be modified without authorization. This is due to a missing capability check within the shopire admin install plugin() function. Attackers with Subscriber-level access or higher can install the 'fable-extra' plugin.

Recommendations Update the Shopire theme to version 1.0.58 or later.

Correção

Enumeração de Fraquezas

CWE-15

Identificadores relacionados

CVE-2025-13091

Produtos afetados

Shopire

Fable Extra

Referências · 8

• https://twitter.com/CVEnew/status/2024501281482809775 · Publicação no Twitter
• https://themes.svn.wordpress.org/shopire/1.0.50/inc/admin/getting-started.php · Nota
• https://themes.trac.wordpress.org/browser/shopire/1.0.50/inc/admin/assets/js/shopire-admin-script.js · Nota
• https://themes.trac.wordpress.org/changeset/304732 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/873b54ba-d29f-4e09-9dc1-a38c10ebfcb1?source=cve · Nota
• https://themes.svn.wordpress.org/shopire/1.0.50/inc/admin/assets/js/shopire-admin-script.js · Nota
• https://themes.trac.wordpress.org/browser/shopire/1.0.50/inc/admin/getting-started.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-13091 · Nota de Segurança