CVE-2025-10850

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10850", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-22T06:50:24.943Z", "datePublished": "2025-10-16T06:47:30.221Z", "dateUpdated": "2026-04-08T17:14:32.471Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:32.471Z"}, "affected": [{"vendor": "RiceTheme", "product": "Felan Framework", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue."}], "title": "Felan Framework <= 1.1.4 - Hardcoded Credentials", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4c7656-544c-4f2f-a42f-264ac90e3b61?source=cve"}, {"url": "https://themeforest.net/item/felan-freelance-marketplace-and-job-board-wordpress-theme/53612955"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-798 Use of Hard-coded Credentials", "cweId": "CWE-798", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-09-22T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-15T18:07:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-16T13:32:13.594518Z", "id": "CVE-2025-10850", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T15:37:09.849Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10850", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-16T13:32:13.594518Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T13:32:15.567Z"}}], "cna": {"title": "Felan Framework <= 1.1.4 - Hardcoded Credentials", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "RiceTheme", "product": "Felan Framework", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-22T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-15T18:07:35.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4c7656-544c-4f2f-a42f-264ac90e3b61?source=cve"}, {"url": "https://themeforest.net/item/felan-freelance-marketplace-and-job-board-wordpress-theme/53612955"}], "descriptions": [{"lang": "en", "value": "The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:32.471Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10850", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:32.471Z", "dateReserved": "2025-09-22T06:50:24.943Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-16T06:47:30.221Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Felan Framework", "vendor": "RiceTheme", "versions": [{"lessThanOrEqual": "1.1.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue."}, {"lang": "es", "value": "El plugin Felan Framework para WordPress es vulnerable a autenticaci\u00f3n impropia en versiones hasta la 1.1.4, inclusive. Esto se debe a la contrase\u00f1a codificada en la funci\u00f3n 'fb_ajax_login_or_register' y en la funci\u00f3n 'google_ajax_login_or_register'. Esto hace posible que atacantes no autenticados inicien sesi\u00f3n como cualquier usuario existente en el sitio, si se registraron con inicio de sesi\u00f3n social de Facebook o Google y no cambiaron su contrase\u00f1a."}], "id": "CVE-2025-10850", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10850", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-16T13:32:13.594518Z", "version": "2.0.3"}}]}, "published": "2025-10-16T07:15:32.897", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/felan-freelance-marketplace-and-job-board-wordpress-theme/53612955"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4c7656-544c-4f2f-a42f-264ac90e3b61?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:49:54.002620+00:00", "value": {"mitigation_remediation": ["Update the Felan Framework plugin to the latest officially released version that removes hardcoded passwords.", "If an update is not yet available, disable the 'facebook' and 'google' AJAX login routes or remove the social\u2011login add\u2011ons entirely until the issue is fixed.", "Audit the plugin\u2019s source code for any remaining hardcoded credentials or insecure authentication paths, and apply remedial fixes such as enforcing password change on registration or adding two\u2011factor authentication.", "Strengthen overall site security by enforcing strong password policies and monitoring login attempts for suspicious activity."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "Affected parties are owners and administrators of WordPress installations running the RiceTheme Felan Framework plugin version\u202f1.1.4 or earlier. The vulnerability exists across all installations of the plugin that have not been updated beyond this version threshold.", "description_and_impact": "The vulnerability stems from hardcoded credentials embedded in the 'fb_ajax_login_or_register' and 'google_ajax_login_or_register' functions of the Felan Framework plugin. This flaw allows unauthenticated callers to authenticate as any user who registered via Facebook or Google and did not change the default password, effectively bypassing the normal authentication process. The compromised accounts could be used for data theft, privilege escalation, or to spread malicious content.", "risk_and_exploitability": "With a CVSS score of\u202f9.8 the flaw is considered critical. The EPSS score is below 1\u202f% and the vulnerability is not listed in CISA\u2019s KEV catalog, indicating that documented exploitation is rare at present. However, the likely attack vector, based on the description, is external and requires no authentication, so an attacker can exploit the flaw simply by sending the vulnerable AJAX requests to the public site endpoints, assuming the social\u2011login routes are enabled. The lack of login monitoring and the use of hardcoded passwords make exploitation straightforward once the target is identified."}}}}, "created": "2025-10-20T13:25:18.462382+00:00", "updated": "2026-04-21T19:00:36.132653+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}