PT-2025-4660 · Wpexperts · Wpexperts User Management

Muhamad Agil Fachrian · Published 2025-01-15 · Updated 2025-01-15 · CVE-2025-22736

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPExperts User Management versions 1.2 and earlier

Description The issue is related to an incorrect privilege assignment, allowing privilege escalation. This problem affects WPExperts User Management, enabling potential attackers to gain higher privileges than intended.

Recommendations For versions 1.2 and earlier, update to a version that includes the fix for this issue, as the current version allows privilege escalation due to incorrect privilege assignment. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-22736

Affected Products

Wpexperts User Management

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-22736 · Security Note
• https://twitter.com/CVEnew/status/1879657498807865488 · Twitter Post
• https://twitter.com/CveFindCom/status/1879552477151797601 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/user-management/vulnerability/wordpress-user-management-plugin-1-2-privilege-escalation-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/user-management/vulnerability/wordpress-user-management-plugin-1-2-privilege-escalation-vulnerability?_s_id=cve · Note