CVE-2025-11533

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11533", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-08T19:53:45.076Z", "datePublished": "2025-10-11T07:25:56.458Z", "dateUpdated": "2026-04-08T16:35:19.502Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:19.502Z"}, "affected": [{"vendor": "ApusTheme", "product": "WP Freeio", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.21", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site."}], "title": "WP Freeio <= 1.2.21 - Unauthenticated Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=cve"}, {"url": "https://themeforest.net/item/freeio-freelance-marketplace-wordpress-theme/42045416"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "timeline": [{"time": "2025-10-10T15:35:52.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-10T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T13:31:39.632545Z", "id": "CVE-2025-11533", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T14:12:42.701Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11533", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-14T13:31:39.632545Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T13:31:41.145Z"}}], "cna": {"title": "WP Freeio <= 1.2.21 - Unauthenticated Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "ApusTheme", "product": "WP Freeio", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.21"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-10T15:35:52.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-10T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=cve"}, {"url": "https://themeforest.net/item/freeio-freelance-marketplace-wordpress-theme/42045416"}], "descriptions": [{"lang": "en", "value": "The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:19.502Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11533", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:35:19.502Z", "dateReserved": "2025-10-08T19:53:45.076Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-11T07:25:56.458Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Freeio", "vendor": "ApusTheme", "versions": [{"lessThanOrEqual": "1.2.21", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site."}, {"lang": "es", "value": "El plugin WP Freeio para WordPress es vulnerable a escalada de privilegios en todas las versiones hasta la 1.2.21, inclusive. Esto se debe a que la funci\u00f3n process_register() no restringe los roles de usuario con los que un usuario puede registrarse. Esto permite que atacantes no autenticados proporcionen el rol de 'administrador' durante el registro y obtengan acceso de administrador al sitio."}], "id": "CVE-2025-11533", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11533", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-14T13:31:39.632545Z", "version": "2.0.3"}}]}, "published": "2025-10-11T08:15:32.157", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/freeio-freelance-marketplace-wordpress-theme/42045416"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T23:43:08.882616+00:00", "value": {"mitigation_remediation": ["Update the WP Freeio plugin to the newest version that includes the role\u2011restriction fix; if unable to update, disable the plugin or migrate to a different marketplace theme.", "Secure or disable the public registration page to prevent unauthenticated role assignments during sign\u2011ups.", "Enforce role validation server\u2011side by restricting role options to authorized users only, ensuring that role parameters passed during registration are ignored for non\u2011admin users who are not logged in."], "summary": {"action": "Patch Immediately", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The flaw exists in the ApusTheme WP Freeio plugin for WordPress in all releases up to and including version\u00a01.2.21. Any site running one of these releases is at risk; versions newer than 1.2.21 are not known to be affected.", "description_and_impact": "The WP Freeio plugin\u2019s process_register() function fails to enforce role restrictions during user registration. As a result, any visitor can submit the 'administrator' role, causing the system to grant full admin privileges to an unauthenticated account. This vulnerability is a classic case of privilege escalation (CWE\u2011269) and would allow an attacker to modify, delete, or steal site data and install additional malicious components.", "risk_and_exploitability": "The CVSS score of 9.8 categorizes this flaw as critical. An attacker can exploit it from any network location using the public registration form, with no prior authentication required. Although the EPSS score is below 1\u202f%, indicating a low overall exploitation probability, the ease of attack and the severity of the potential impact justify immediate attention. The flaw is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, but its high severity warrants concern."}}}}, "created": "2025-10-20T16:17:06.252046+00:00", "updated": "2026-04-27T23:45:15.897358+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}