PT-2025-6164 · WordPress · Wp Foodbakery

Tonn

·

Published

2025-02-11

·

Updated

2025-02-16

·

CVE-2025-0181

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: WP Foodbakery plugin for WordPress versions up to, and including, 4.7
Description: The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authentication cookie, making it possible for unauthenticated attackers to gain access to a target user's account, such as administrators.
Recommendations: For WP Foodbakery plugin for WordPress versions up to, and including, 4.7, update to a version that fixes this issue, as the current version allows unauthenticated attackers to gain access to user accounts due to improper validation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-0181

Affected Products

Wp Foodbakery