PT-2025-41360 · WordPress · Search & Go - Directory Wordpress Theme

Khanhhnahk1 · Published 2025-10-09 · Updated 2025-10-09 · CVE-2025-11522

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Search & Go - Directory WordPress Theme versions prior to 2.7

Description The Search & Go - Directory WordPress Theme is susceptible to authentication bypass, potentially leading to account takeover. This occurs due to inadequate user validation within the search and go elated check facebook user() function. When Facebook login is enabled, unauthenticated attackers may gain access to other user accounts, including administrator accounts.

Recommendations Update to a version newer than 2.7.

Fix

LPE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-11522

Affected Products

Search & Go - Directory Wordpress Theme

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-11522 · Security Note
• https://t.me/cveNotify/137948 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/da590a65-8728-4577-b6e4-ecebc2a2277d?source=cve · Note
• https://themeforest.net/item/search-go-modern-smart-directory-theme/15365040 · Note
• https://twitter.com/VulmonFeeds/status/1976225854515453953 · Twitter Post
• https://t.me/CVEtracker/34509 · Telegram Post
• https://twitter.com/0dayPublishing/status/1976190889585222132 · Twitter Post
• https://twitter.com/CVEnew/status/1976191034515153317 · Twitter Post