CVE-2025-8359: falha crítica em scriptsbundle AdForest
AdForest <= 6.0.9 - Authentication Bypass to Admin
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.5%
The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, including administrators, without access to a password.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
scriptsbundle · AdForestCVEs relacionadas — scriptsbundle AdForest
No mesmo produto, das mais perigosas para as menos.
CVE-2024-11349CRITICALAdForest <= 5.1.6 - Authentication BypassEPSS 1.2%CVE-2024-12857CRITICALAdForest <= 5.1.8 - Authentication BypassEPSS 0.8%CVE-2024-11350CRITICALAdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account TakeoverEPSS 0.7%CVE-2026-1729CRITICALAdForest <= 6.0.12 - Authentication BypassEPSS 0.6%CVE-2025-67946HIGHWordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2024-12855MEDIUMAdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment DeletionEPSS 0.3%