PT-2025-29990 · WordPress · Aapanel Wp Toolkit

Kenneth Dunn · Published 2025-07-18 · Updated 2026-03-17 · CVE-2025-6813

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions aapanel WP Toolkit versions 1.0 through 1.1

Description The aapanel WP Toolkit plugin for WordPress is susceptible to privilege escalation due to missing authorization checks within the auto login() function. Authenticated attackers with Subscriber-level access or higher can bypass role checks and obtain full admin privileges.

Recommendations Update aapanel WP Toolkit to a version newer than 1.1.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-6813

Affected Products

Aapanel Wp Toolkit

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-6813 · Security Note
• https://t.me/cvenotify/129806 · Telegram Post
• https://t.me/cveNotify/129806 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/430a0b93-2cb7-45bf-86ac-4a8b3a0be77a?source=cve · Note
• https://t.me/cvenotify/129403 · Telegram Post
• https://twitter.com/ClearanceJobs/status/2033898703493169654 · Twitter Post
• https://t.me/cvetracker/28099 · Telegram Post
• https://twitter.com/CveFindCom/status/1946067532181307449 · Twitter Post
• https://twitter.com/CVEnew/status/1946078250154815891 · Twitter Post
• https://wordpress.org/plugins/aapanel-wp-toolkit/#developers · Note
• https://twitter.com/VulmonFeeds/status/1946083479453643137 · Twitter Post
• https://plugins.trac.wordpress.org/browser/aapanel-wp-toolkit/tags/1.1/includes/class-aapanel-wp-toolkit-agent.php#L74 · Note