PT-2025-50569 · WordPress · Wp Cardealer

Friderika Baranyai · CVE-2025-13764 · Published 2025-12-11 · Updated 2025-12-11

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP CarDealer plugin for WordPress versions prior to 1.2.17

Description The WP CarDealer plugin for WordPress is susceptible to a privilege escalation issue. The WP CarDealer User::process register function does not adequately restrict user role assignments during registration. This allows unauthenticated attackers to register with the 'administrator' role, gaining unauthorized administrative access to the WordPress site.

Recommendations Versions prior to 1.2.17 should be updated. As a temporary workaround, restrict user registrations until a patch is available.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-13764

Affected Products

Wp Cardealer

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13764 · Security Note
• https://twitter.com/CveFindCom/status/1998960676488790050 · Twitter Post
• https://twitter.com/CVEnew/status/1999108883210703091 · Twitter Post
• https://t.me/cveNotify/145404 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f4893d9c-e039-43df-80b9-dbe42374caed?source=cve · Note
• https://twitter.com/0dayPublishing/status/1998945921413890152 · Twitter Post
• https://twitter.com/offseq/status/1998966590306660849 · Twitter Post
• https://t.me/CVEtracker/39438 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1999037872947478850 · Twitter Post
• https://themeforest.net/item/boxcar-automotive-car-dealer-wordpress-theme/49741717 · Note