PT-2025-25201 · WordPress · Cubewp

Friderika Baranyai · Published 2025-06-11 · Updated 2025-07-10 · CVE-2025-4315

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress version 1.1.23 and earlier

Description The issue is related to Privilege Escalation, allowing authenticated attackers with Subscriber-level access and above to elevate their privileges to that of an administrator. This is due to the plugin permitting a user to update arbitrary user meta through the update user meta() function.

Recommendations For versions up to and including 1.1.23, consider disabling the update user meta() function as a temporary workaround until a patch is available. Restrict access to user meta updates to minimize the risk of exploitation.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-4315

Affected Products

Cubewp

References · 13

• https://osv.dev/vulnerability/CVE-2025-4315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4315 · Security Note
• https://plugins.trac.wordpress.org/changeset/3306925/cubewp-framework#file2 · Patch
• https://t.me/cvenotify/125367 · Telegram Post
• https://t.me/latest_high_impact_cve/2606 · Telegram Post
• https://t.me/latest_high_impact_cve/2605 · Telegram Post
• https://twitter.com/CveFindCom/status/1932734735291240868 · Twitter Post
• https://t.me/cvenotify/128299 · Telegram Post
• https://t.me/cvetracker/26013 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/430b7e72-72b8-4cf8-99f4-ee1d1d4b4f24?source=cve · Note
• https://twitter.com/CVEnew/status/1932735439611351541 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1932776506725367819 · Twitter Post
• https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.23/cube/classes/class-cubewp-rest-api.php#L691 · Note