CVE-2025-10706

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10706", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-19T04:43:46.331Z", "datePublished": "2025-10-16T06:47:29.202Z", "dateUpdated": "2026-04-08T16:43:18.860Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:18.860Z"}, "affected": [{"vendor": "Cridio Studio", "product": "ClassifiedPro - reCommerce WordPress Theme", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Framework plugin."}], "title": "Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2954583e-4ebe-4658-b132-0085f2b1cf08?source=cve"}, {"url": "https://themeforest.net/item/classifiedpro-recommerce-classified-wordpress-theme/44528010"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-09-19T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-15T17:58:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-16T13:32:35.653643Z", "id": "CVE-2025-10706", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T19:24:17.326Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10706", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-16T13:32:35.653643Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T13:32:41.128Z"}}], "cna": {"title": "Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Cridio Studio", "product": "ClassifiedPro - reCommerce WordPress Theme", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-19T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-15T17:58:17.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2954583e-4ebe-4658-b132-0085f2b1cf08?source=cve"}, {"url": "https://themeforest.net/item/classifiedpro-recommerce-classified-wordpress-theme/44528010"}], "descriptions": [{"lang": "en", "value": "The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Framework plugin."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-16T06:47:29.202Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10706", "state": "PUBLISHED", "dateUpdated": "2025-10-16T19:24:17.326Z", "dateReserved": "2025-09-19T04:43:46.331Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-16T06:47:29.202Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ClassifiedPro - reCommerce WordPress Theme", "vendor": "Cridio Studio", "versions": [{"lessThanOrEqual": "1.0.14", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Framework plugin."}, {"lang": "es", "value": "El tema Classified Pro para WordPress es vulnerable a la instalaci\u00f3n no autorizada de plugins debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n 'cwp_addons_update_plugin_cb' en todas las versiones hasta la 1.0.14, inclusive. Esto permite a atacantes autenticados, con acceso de nivel de suscriptor y superior, instalar plugins arbitrarios en el servidor del sitio afectado, lo que puede hacer posible la ejecuci\u00f3n remota de c\u00f3digo. Nota: El nonce requerido para la vulnerabilidad se encuentra en el plugin CubeWP Framework."}], "id": "CVE-2025-10706", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10706", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-16T13:32:35.653643Z", "version": "2.0.3"}}]}, "published": "2025-10-16T07:15:32.270", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/classifiedpro-recommerce-classified-wordpress-theme/44528010"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2954583e-4ebe-4658-b132-0085f2b1cf08?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T22:01:45.882564+00:00", "value": {"mitigation_remediation": ["Update Classified Pro to the latest available version (1.0.15 or newer) to remove the missing capability check.", "Remove or disable the CubeWP Framework plugin if it is not required, or restrict its use to trusted administrators.", "Revoke or downgrade the capability that allows users to install plugins for subscriber roles and lower.", "Apply stricter file\u2011system permissions so that only the web server user can write to plugin directories.", "Audit the site\u2019s plugin directory for recently added plugins and review their source."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized installation of arbitrary plugins that may lead to remote code execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Cridio Studio\u2019s ClassifiedPro reCommerce WordPress Theme in all releases up to and including version\u00a01.0.14. Any site that has installed one of those versions is at risk.", "description_and_impact": "Classified Pro, a WordPress theme, is vulnerable due to a missing capability check in the \"cwp_addons_update_plugin_cb\" function. Authenticated users with subscriber level access and higher can exploit this flaw to install arbitrary plugins on the site\u2019s server. Installing such plugins can provide the attacker with remote code execution capabilities, enabling full compromise of the website.", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity impact, while the EPSS score of <\u00a01\u202f% suggests that widespread exploitation is currently unlikely. This vulnerability is not yet listed in CISA\u2019s KEV catalog. Attacking this flaw requires an authenticated session with at least subscriber permissions and knowledge of the nonce supplied by the CubeWP Framework plugin. Once the attacker gains plugin\u2011upload access, arbitrary code can be deployed on the server."}}}}, "created": "2025-10-21T09:40:45.400453+00:00", "updated": "2026-04-22T22:15:26.346959+00:00", "vendors": ["cridio_studio", "cridio_studio$PRODUCT$classifiedpro", "wordpress", "wordpress$PRODUCT$wordpress"]}