PT-2025-17713 · WordPress · Configurator Theme Core

Tonn · Published 2025-04-24 · Updated 2025-04-29 · CVE-2025-3101

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Configurator Theme Core plugin for WordPress versions up to, and including, 1.4.7

Description The issue is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change and escalate their privileges to Administrator.

Recommendations For versions up to, and including, 1.4.7, update to a version that properly validates user meta fields to prevent privilege escalation. As a temporary workaround, consider restricting access to user meta fields until a patch is available.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-3101

Affected Products

Configurator Theme Core

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-3101 · Security Note
• https://twitter.com/cracbot/status/1917172079457153431 · Twitter Post
• https://t.me/cvetracker/22272 · Telegram Post
• https://themeforest.net/item/configurator-woocommerce-wordpress-theme/20474230 · Note
• https://twitter.com/CVEnew/status/1915329395574607949 · Twitter Post
• https://twitter.com/CveFindCom/status/1915330865204175056 · Twitter Post
• https://t.me/cvedetector/23667 · Telegram Post
• https://twitter.com/vulns_space/status/1915344735381712993 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/535aa061-479f-415e-bee6-3151c42b917e?source=cve · Note