CVE-2025-3604criticalCWE-862

CVE-2025-3604: fallo crítico en v1rustyle Flynax Bridge

Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Flynax Bridge

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.7%
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
v1rustyle · Flynax Bridge
CVEs relacionadas — v1rustyle Flynax Bridge

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-3603CRITICALFlynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password UpdateEPSS 0.6%CVE-2025-4179HIGHFlynax Bridge <= 2.2.0 - Unauthenticated Limited Privilege EscalationEPSS 0.4%CVE-2025-4177MEDIUMFlynax Bridge <= 2.2.0 - Unauthenticated Arbitrary User DeletionEPSS 0.4%