PT-2026-20597 · WordPress · Shopire+1

Ky0Tofu · Published 2026-02-19 · Updated 2026-02-19 · CVE-2025-13091

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shopire theme for WordPress versions prior to 1.0.58

Description The Shopire theme for WordPress has an issue where data can be modified without authorization. This is due to a missing capability check within the shopire admin install plugin() function. Attackers with Subscriber-level access or higher can install the 'fable-extra' plugin.

Recommendations Update the Shopire theme to version 1.0.58 or later.

Fix

Weakness Enumeration

CWE-15

Related Identifiers

CVE-2025-13091

Affected Products

Shopire

Fable Extra

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13091 · Security Note
• https://twitter.com/CVEnew/status/2024501281482809775 · Twitter Post
• https://themes.svn.wordpress.org/shopire/1.0.50/inc/admin/getting-started.php · Note
• https://themes.trac.wordpress.org/browser/shopire/1.0.50/inc/admin/assets/js/shopire-admin-script.js · Note
• https://themes.trac.wordpress.org/changeset/304732 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/873b54ba-d29f-4e09-9dc1-a38c10ebfcb1?source=cve · Note
• https://themes.svn.wordpress.org/shopire/1.0.50/inc/admin/assets/js/shopire-admin-script.js · Note
• https://themes.trac.wordpress.org/browser/shopire/1.0.50/inc/admin/getting-started.php · Note