CVE-2025-10293

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10293", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-11T19:45:14.095Z", "datePublished": "2025-10-15T08:25:50.156Z", "dateUpdated": "2026-04-08T16:37:36.636Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:36.636Z"}, "affected": [{"vendor": "nexist", "product": "Keyy Two Factor Authentication (like Clef)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity associated with a token generated. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate valid auth tokens and leverage that to auto-login as other accounts, including administrators, as long as the administrator has the 2FA set up."}], "title": "Keyy Two Factor Authentication (like Clef) <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1850e6bd-04bc-4510-aba9-e51431363231?source=cve"}, {"url": "https://wordpress.org/plugins/keyy/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-287 Improper Authentication", "cweId": "CWE-287", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-10-14T20:04:20.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-15T15:28:11.621521Z", "id": "CVE-2025-10293", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T15:28:36.069Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10293", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-15T15:28:11.621521Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T15:28:28.291Z"}}], "cna": {"title": "Keyy Two Factor Authentication (like Clef) <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "nexist", "product": "Keyy Two Factor Authentication (like Clef)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-14T20:04:20.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1850e6bd-04bc-4510-aba9-e51431363231?source=cve"}, {"url": "https://wordpress.org/plugins/keyy/"}], "descriptions": [{"lang": "en", "value": "The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity associated with a token generated. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate valid auth tokens and leverage that to auto-login as other accounts, including administrators, as long as the administrator has the 2FA set up."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:36.636Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10293", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:37:36.636Z", "dateReserved": "2025-09-11T19:45:14.095Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-15T08:25:50.156Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Keyy Two Factor Authentication (like Clef)", "vendor": "nexist", "versions": [{"lessThanOrEqual": "1.2.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity associated with a token generated. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate valid auth tokens and leverage that to auto-login as other accounts, including administrators, as long as the administrator has the 2FA set up."}, {"lang": "es", "value": "El plugin Keyy Two Factor Authentication (como Clef) para WordPress es vulnerable a escalada de privilegios mediante toma de control de cuenta en todas las versiones hasta la 1.2.3, inclusive. Esto se debe a que el plugin no valida correctamente la identidad de un usuario asociada con un token generado. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, generen tokens de autenticaci\u00f3n v\u00e1lidos y aprovechen eso para iniciar sesi\u00f3n autom\u00e1ticamente como otras cuentas, incluyendo administradores, siempre y cuando el administrador tenga la 2FA configurada."}], "id": "CVE-2025-10293", "lastModified": "2026-10-08T12:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10293", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-15T15:28:11.621521Z", "version": "2.0.3"}}]}, "published": "2025-10-15T09:15:38.850", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/keyy/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1850e6bd-04bc-4510-aba9-e51431363231?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T22:03:51.158807+00:00", "value": {"mitigation_remediation": ["Upgrade the Keyy Two Factor Authentication (like Clef) plugin to version 1.2.4 or later", "If the update is not available, remove or deactivate the plugin to eliminate the flaw", "Implement stricter role\u2011based access control, ensuring that only essential users can generate authentication tokens, and consider requiring additional verification before allowing token creation or use"], "summary": {"action": "Patch Now", "impact": "Privilege Escalation via Account Takeover"}, "threat_synthesis": {"affected_systems": "The flaw affects WordPress sites that have the Keyy Two Factor Authentication (like Clef) plugin installed at version 1.2.3 or earlier. The vulnerability is confined to the plugin itself; it requires an active WordPress installation with the plugin enabled. All users with subscriber or higher privileges are potentially capable of exploiting it if the system has no additional protections.", "description_and_impact": "The vulnerability exists in the Keyy Two Factor Authentication (like Clef) plugin for WordPress, versions up to 1.2.3. The flaw arises because the plugin fails to validate the identity associated with tokens it generates. As a result, any authenticated user with at least subscriber level can fabricate a valid authentication token and use it to bypass two\u2011factor authentication, effectively logging in as another account, including administrators if they have 2FA enabled. This enables privilege escalation, allowing attackers to compromise the site\u2019s integrity and confidentiality (CWE\u2011287).", "risk_and_exploitability": "The Common Vulnerability Scoring System rates this issue at 8.8, classifying it as high severity. EPSS indicates a very low exploitation probability (<1%) at the moment, and the vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. The attack vector is authenticated; an attacker must first obtain valid credentials with subscriber\u2011level access. Once inside, they can generate forged tokens through the plugin\u2019s token\u2011generation endpoint and instantly hijack any target account that has two\u2011factor authentication activated, resulting in immediate privilege escalation across the site."}}}}, "created": "2025-10-21T09:41:14.670579+00:00", "updated": "2026-04-22T22:15:26.348400+00:00", "vendors": ["nexist", "nexist$PRODUCT$keyy_two_factor_authentication", "wordpress", "wordpress$PRODUCT$wordpress"]}