PT-2025-48230 · WordPress · Tiger Theme

Ismail Syaleh · Published 2025-11-27 · Updated 2025-11-28 · CVE-2025-13675

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tiger theme for WordPress versions prior to 101.2.2

Description The Tiger theme for WordPress is susceptible to a privilege escalation issue. The paypal-submit.php file does not properly restrict user roles during registration. This allows unauthenticated attackers to specify the 'administrator' role during registration, thereby gaining administrative access to the site.

Recommendations Versions prior to 101.2.2: Disable the paypal-submit.php file.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-13675

Affected Products

Tiger Theme

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-13675 · Security Note
• https://twitter.com/CVEnew/status/1993906107215999308 · Twitter Post
• https://t.me/CVEtracker/38363 · Telegram Post
• https://twitter.com/0dayPublishing/status/1993902625687793925 · Twitter Post
• https://twitter.com/The_SatyaDVV/status/1994318900000117088 · Twitter Post
• https://twitter.com/CveFindCom/status/1993917918954877411 · Twitter Post
• https://twitter.com/offseq/status/1993968814304678009 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4750b57e-7d8d-49d7-bbbf-46483eb97bd9?source=cve · Note
• https://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995 · Note