CVE-2025-3604criticalCWE-862

CVE-2025-3604: falha crítica em v1rustyle Flynax Bridge

Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Flynax Bridge

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.7%
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
v1rustyle · Flynax Bridge
CVEs relacionadas — v1rustyle Flynax Bridge

No mesmo produto, das mais perigosas para as menos.

CVE-2025-3603CRITICALFlynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password UpdateEPSS 0.6%CVE-2025-4179HIGHFlynax Bridge <= 2.2.0 - Unauthenticated Limited Privilege EscalationEPSS 0.4%CVE-2025-4177MEDIUMFlynax Bridge <= 2.2.0 - Unauthenticated Arbitrary User DeletionEPSS 0.4%