PT-2025-6163 · WordPress · Wp Foodbakery

Tonn · Published 2025-02-11 · Updated 2025-02-17 · CVE-2025-0180

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WP Foodbakery plugin for WordPress versions prior to 3.4

Description: The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.

Recommendations: For WP Foodbakery plugin for WordPress versions prior to 3.4, update to a version later than 3.3 to resolve the issue. As a temporary workaround, consider restricting user registration or limiting the privileges of newly registered users until the update can be applied.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-0180

Affected Products

Wp Foodbakery

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-0180 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=cve · Note
• https://twitter.com/cracbot/status/1891080177570173221 · Twitter Post
• https://t.me/cvenotify/110758 · Telegram Post
• https://t.me/latest_high_impact_cve/1815 · Telegram Post
• https://twitter.com/cybercronai/status/1889542548110098859 · Twitter Post
• https://t.me/cvedetector/17667 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1891365209727517039 · Twitter Post
• https://twitter.com/CVEnew/status/1889211216779993198 · Twitter Post
• https://twitter.com/CveFindCom/status/1889208271396855890 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1889268658171510951 · Twitter Post
• https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331 · Note