PT-2025-34522 · WordPress · Bravis User

Phat Rio · Published 2025-08-23 · Updated 2025-08-23 · CVE-2025-5060

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bravis User plugin for WordPress versions up to and including 1.0.0

Description: The plugin does not properly log in a user with data verified through the facebook ajax login callback() function, leading to authentication bypass. This allows unauthenticated attackers to log in as administrative users if they have an existing account on the site and access to the administrative user's email.

Recommendations: Update the Bravis User plugin to a version beyond 1.0.0.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-5060

Affected Products

Bravis User

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-5060 · Security Note
• https://t.me/CVEtracker/30780 · Telegram Post
• https://themeforest.net/item/graviton-construction-wordpress-theme/50429299 · Note
• https://t.me/cveNotify/133258 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c6c52f1a-2203-4abe-b777-064bd6fd1714?source=cve · Note
• https://twitter.com/CVEnew/status/1959147712533696782 · Twitter Post