PT-2026-46208 · Framework · Hybrid Composer

Yasin · Publicado 2026-06-04 · Atualizado 2026-06-04 · CVE-2019-25738

Mitre

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc ajax save option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc ajax save option to enable user registration and set the default role to administrator, enabling account takeover.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-25738

Produtos afetados

Hybrid Composer

Referências · 6

• 🔥 https://exploit-db.com/exploits/47154 · Exploit
• http://wordpress.framework-y.com · Nota
• https://vulncheck.com/advisories/wordpress-hybrid-composer-unauthenticated-settings-change · Nota
• https://labs.sucuri.net/wptf-hybrid-composer-unauthenticated-arbitrary-options-update · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25738 · Nota de Segurança
• http://wordpress.framework-y.com/hybrid-composer · Nota