PT-2025-34523 · WordPress · Case Theme User

Friderika Baranyai · Published 2025-08-23 · Updated 2025-10-22 · CVE-2025-5821

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Case Theme User plugin for WordPress versions prior to 1.0.4

Description The Case Theme User plugin for WordPress is susceptible to an authentication bypass. This issue stems from the plugin's failure to correctly log in a user with data previously verified through the facebook ajax login callback() function. This allows unauthenticated attackers to log in as administrative users if they possess an existing account on the site and have access to the administrative user's email address. This vulnerability is actively exploited in the wild, with over 1,700 vulnerable sites identified. Approximately 27,000 vulnerable sites have been found in the past year.

Recommendations Update to version 1.0.4 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-5821

Affected Products

Case Theme User

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-5821 · Security Note
• https://themeforest.net/item/consultio-consulting-business-wordpress/25376496 · Note
• https://t.me/pentestingnews/68171 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3ce95a04-11bd-488e-ad25-1b661e083eb2?source=cve · Note
• https://t.me/CVEtracker/30782 · Telegram Post
• https://twitter.com/CveFindCom/status/1959151096238121426 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1959231424973635790 · Twitter Post
• https://twitter.com/fofabot/status/1967840647752384679 · Twitter Post
• https://twitter.com/CVEnew/status/1959147713523589248 · Twitter Post
• https://twitter.com/fridaysecurity/status/1967780269680988179 · Twitter Post
• https://twitter.com/Komodosec/status/1981059367048040549 · Twitter Post
• https://t.me/netlas/476 · Telegram Post
• https://twitter.com/CrowdCyber_Com/status/1967782648987717967 · Twitter Post
• https://twitter.com/dailytechonx/status/1968053527995093052 · Twitter Post
• https://t.me/cveNotify/133260 · Telegram Post