CVE-2025-10849: falha de média gravidade em RiceTheme Felan Framework
Felan Framework <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_plugin_actions' function called via an AJAX action in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to activate or deactivate arbitrary plugins.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
RiceTheme · Felan FrameworkCVEs relacionadas — RiceTheme Felan Framework
No mesmo produto, das mais perigosas para as menos.
CVE-2025-10850CRITICALFelan Framework <= 1.1.4 - Hardcoded CredentialsEPSS 0.6%CVE-2025-23504CRITICALWordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerabilityEPSS 0.5%CVE-2025-23993CRITICALWordPress Felan Framework plugin <= 1.1.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-22741HIGHWordPress Felan Framework plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%