PT-2026-46208 · Framework · Hybrid Composer

Yasin · Published 2026-06-04 · Updated 2026-06-04 · CVE-2019-25738

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc ajax save option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc ajax save option to enable user registration and set the default role to administrator, enabling account takeover.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-25738

Affected Products

Hybrid Composer

References · 6

• 🔥 https://exploit-db.com/exploits/47154 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25738 · Security Note
• http://wordpress.framework-y.com · Note
• https://vulncheck.com/advisories/wordpress-hybrid-composer-unauthenticated-settings-change · Note
• https://labs.sucuri.net/wptf-hybrid-composer-unauthenticated-arbitrary-options-update · Note
• http://wordpress.framework-y.com/hybrid-composer · Note