CVE-2025-0180: fallo crítico en Chimpstudio WP Foodbakery
WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation
Publicada el · Actualizada el
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 0.5%
probabilidad de explotación
0.5%top 57% de las CVE
explotación observada
noninguna fuente lo reporta
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Chimpstudio · WP FoodbakeryCVEs relacionadas — Chimpstudio WP Foodbakery
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-24389—FoodBakery < 2.2 - Reflected Cross-Site Scripting (XSS)EPSS 3.8%CVE-2024-13011CRITICALWP Foodbakery <= 4.7 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2026-15802HIGHWP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX ActionEPSS 0.8%CVE-2025-0181CRITICALWP Foodbakery <= 4.8 - Authentication Bypass in foodbakery_parse_requestEPSS 0.6%CVE-2024-13010MEDIUMWP Foodbakery <= 4.8 - Reflected Cross-Site ScriptingEPSS 0.3%