PT-2026-20608 · WordPress+1 · Buyent Classified+1

Ismail Syaleh · Publicado 2026-02-19 · Atualizado 2026-03-04 · CVE-2025-13851

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Buyent Classified plugin for WordPress versions up to and including 1.0.7

Description The Buyent Classified plugin for WordPress, when bundled with the Buyent theme, has a flaw that allows unauthorized privilege escalation through the user registration process. The plugin does not properly validate or restrict user roles during registration via the REST API. An attacker can manipulate the buyent classified user type parameter during registration to assign themselves arbitrary roles, including administrator, gaining complete control of the WordPress site. This occurs because the registration process lacks sufficient authentication checks.

Recommendations Update the Buyent Classified plugin to a version later than 1.0.7.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2025-13851

Produtos afetados

Buyent Classified

Buyent Theme

Referências · 7

• https://wordfence.com/threat-intel/vulnerabilities/id/f3e618cf-dd77-45a7-ab57-5732fd329883?source=cve · Nota
• https://twitter.com/CVEnew/status/2024360204952097278 · Publicação no Twitter
• https://t.me/CVEtracker/45083 · Publicação no Telegram
• https://themeforest.net/item/buyent-classified-wordpress-theme/32588790 · Nota
• https://twitter.com/0dayPublishing/status/2024347032228348330 · Publicação no Twitter
• https://twitter.com/MNovofastovsky/status/2029126956151902403 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-13851 · Nota de Segurança