PT-2026-20608 · WordPress+1 · Buyent Classified+1

Ismail Syaleh · Published 2026-02-19 · Updated 2026-03-04 · CVE-2025-13851

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Buyent Classified plugin for WordPress versions up to and including 1.0.7

Description The Buyent Classified plugin for WordPress, when bundled with the Buyent theme, has a flaw that allows unauthorized privilege escalation through the user registration process. The plugin does not properly validate or restrict user roles during registration via the REST API. An attacker can manipulate the buyent classified user type parameter during registration to assign themselves arbitrary roles, including administrator, gaining complete control of the WordPress site. This occurs because the registration process lacks sufficient authentication checks.

Recommendations Update the Buyent Classified plugin to a version later than 1.0.7.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-13851

Affected Products

Buyent Classified

Buyent Theme

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13851 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f3e618cf-dd77-45a7-ab57-5732fd329883?source=cve · Note
• https://twitter.com/CVEnew/status/2024360204952097278 · Twitter Post
• https://t.me/CVEtracker/45083 · Telegram Post
• https://themeforest.net/item/buyent-classified-wordpress-theme/32588790 · Note
• https://twitter.com/0dayPublishing/status/2024347032228348330 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2029126956151902403 · Twitter Post