CVE-2025-1671criticalCWE-288

CVE-2025-1671: falha crítica em Elated-Themes Academist Membership

Academist Membership <= 1.1.6 - Authentication Bypass via Account Takeover

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Academist Membership

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.6%
The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academist_membership_check_facebook_user() function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as any user, including site administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Elated-Themes · Academist Membership