PT-2025-42425 · WordPress+1 · Wordpress Classified Pro+1

István Márton · Published 2025-10-16 · Updated 2025-10-21 · CVE-2025-10706

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Classified Pro versions up to and including 1.0.14

Description The Classified Pro theme for WordPress is susceptible to unauthorized plugin installation due to a missing capability check within the cwp addons update plugin cb function. This allows authenticated attackers with subscriber-level access or higher to install arbitrary plugins on the affected WordPress site. The installation of arbitrary plugins may lead to remote code execution. The required nonce for exploitation is found within the CubeWP Framework plugin.

Recommendations Update Classified Pro to a version newer than 1.0.14.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-10706

Affected Products

Cubewp Framework

Wordpress Classified Pro

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-10706 · Security Note
• https://twitter.com/cracbot/status/1980589923611623465 · Twitter Post
• https://themeforest.net/item/classifiedpro-recommerce-classified-wordpress-theme/44528010 · Note
• https://twitter.com/CveFindCom/status/1978720025427976670 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2954583e-4ebe-4658-b132-0085f2b1cf08?source=cve · Note
• https://twitter.com/CVEnew/status/1978932548286976151 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978787733674864709 · Twitter Post
• https://t.me/CVEtracker/35052 · Telegram Post
• https://t.me/cveNotify/138906 · Telegram Post
• https://twitter.com/CveTodo/status/1978724663137087912 · Twitter Post