CVE-2025-5060highCWE-288

CVE-2025-5060: fallo de gravedad alta en Bravis-Themes Bravis User

Bravis User <= 1.0.1 - Authentication Bypass to Account Takeover

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Bravis User

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.1epss 0.4%
The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly logging a user in with the data that was previously verified through the facebook_ajax_login_callback(). This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site, and access to the administrative user's email.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Bravis-Themes · Bravis User