CVE-2025-0181: critical vulnerability in Chimpstudio WP Foodbakery
WP Foodbakery <= 4.8 - Authentication Bypass in foodbakery_parse_request
Published · Updated
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.6%
exploitation probability
0.6%top 52% of all CVEs
observed exploitation
nono source reports it
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authentication cookie. This makes it possible for unauthenticated attackers to gain access to a target user's (e.g. administrators) account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Chimpstudio · WP FoodbakeryRelated CVEs — Chimpstudio WP Foodbakery
In the same product, most dangerous first.
CVE-2021-24389—FoodBakery < 2.2 - Reflected Cross-Site Scripting (XSS)EPSS 3.8%CVE-2024-13011CRITICALWP Foodbakery <= 4.7 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2026-15802HIGHWP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX ActionEPSS 0.8%CVE-2025-0180CRITICALWP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validationEPSS 0.5%CVE-2024-13010MEDIUMWP Foodbakery <= 4.8 - Reflected Cross-Site ScriptingEPSS 0.3%