CVE-2025-1681: falha de média gravidade em ThemeMakers Car Dealer Automotive WordPress…
Cardealer <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS Files
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.4%
The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sanitization on the demo theme scheme AJAX functions in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to change or delete arbitrary css and js files.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
ThemeMakers · Car Dealer Automotive WordPress Theme – ResponsiveCVEs relacionadas — ThemeMakers Car Dealer Automotive WordPress…
No mesmo produto, das mais perigosas para as menos.
CVE-2025-1282HIGHCar Dealer Automotive WordPress Theme – Responsive <= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Deletion and ReadEPSS 1.1%CVE-2025-1682HIGHCardealer <= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege EscalationEPSS 0.6%CVE-2025-1687HIGHCardealer <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profileEPSS 0.3%