CVE-2025-1295

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1295", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-14T01:08:37.972Z", "datePublished": "2025-02-27T05:23:04.516Z", "dateUpdated": "2026-04-08T17:05:58.688Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:58.688Z"}, "affected": [{"vendor": "Templines", "product": "Templines Elementor Helper Core", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.7. This is due to allowing arbitrary user meta updates. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to Administrator. The vulnerability can only be exploited when the BuddyPress plugin is also installed and activated."}], "title": "Templines Elementor Helper Core <= 2.7 - Authenticated (Subscriber+) Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5aa062-b9a2-4ddb-a5bf-4c8368218e85?source=cve"}, {"url": "http://localhost:1337/wp-content/plugins/templines-helper-core/youzify/youzify.php#L3082"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tonn"}], "timeline": [{"time": "2025-02-26T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-27T14:42:29.213807Z", "id": "CVE-2025-1295", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T14:42:47.733Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1295", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-27T14:42:29.213807Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T14:42:39.956Z"}}], "cna": {"title": "Templines Elementor Helper Core <= 2.7 - Authenticated (Subscriber+) Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Tonn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Templines", "product": "Templines Elementor Helper Core", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-26T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5aa062-b9a2-4ddb-a5bf-4c8368218e85?source=cve"}, {"url": "http://localhost:1337/wp-content/plugins/templines-helper-core/youzify/youzify.php#L3082"}], "descriptions": [{"lang": "en", "value": "The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.7. This is due to allowing arbitrary user meta updates. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to Administrator. The vulnerability can only be exploited when the BuddyPress plugin is also installed and activated."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:58.688Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1295", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:05:58.688Z", "dateReserved": "2025-02-14T01:08:37.972Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-27T05:23:04.516Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Templines Elementor Helper Core", "vendor": "Templines", "versions": [{"lessThanOrEqual": "2.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.7. This is due to allowing arbitrary user meta updates. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to Administrator. The vulnerability can only be exploited when the BuddyPress plugin is also installed and activated."}, {"lang": "es", "value": "El complemento Templines Elementor Helper Core para WordPress es vulnerable a la escalada de privilegios en todas las versiones hasta la 2.7 incluida. Esto se debe a que permite actualizaciones arbitrarias de metadatos de usuarios. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, actualicen su rol a Administrador. La vulnerabilidad solo se puede explotar cuando el complemento BuddyPress tambi\u00e9n est\u00e1 instalado y activado."}], "id": "CVE-2025-1295", "lastModified": "2026-06-17T08:38:45.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1295", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-02-27T14:42:29.213807Z", "version": "2.0.3"}}]}, "published": "2025-02-27T06:15:21.990", "references": [{"source": "security@wordfence.com", "url": "http://localhost:1337/wp-content/plugins/templines-helper-core/youzify/youzify.php#L3082"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5aa062-b9a2-4ddb-a5bf-4c8368218e85?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T02:05:16.750059+00:00", "value": {"mitigation_remediation": ["Update Templines Elementor Helper Core to a version newer than 2.7 to eliminate the privilege escalation flaw.", "If the plugin is not required, consider uninstalling it entirely.", "Disable or remove the BuddyPress plugin if it is not needed for site functionality, thereby removing the prerequisite for exploitation.", "After applying the fix or removal, review existing user accounts to ensure no unauthorized Administrators remain and tighten the permissions granted to Subscriber roles where appropriate."], "summary": {"action": "Apply Patch", "impact": "Privilege escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Templines Elementor Helper Core plugin versions up to and including 2.7. It only applies when the BuddyPress plugin is also installed and activated within the WordPress environment, as the plugin\u2019s meta update functionality is only exposed with BuddyPress active.", "description_and_impact": "The Templines Elementor Helper Core plugin for WordPress allows an authenticated user with Subscriber-level access or higher to update arbitrary user meta data. By exploiting this flaw, an attacker can change their own role to Administrator, giving them full control of the site. The weakness resides in improper validation of user role changes and is classified as CWE\u2011269.", "risk_and_exploitability": "The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score of less than 1% points to a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session with a Subscriber or higher role; from there, the attacker can elevate privileges by modifying user meta data. The requirement for BuddyPress installation limits the attack surface, making the vector internal and constrained to environments where both plugins coexist."}}}}, "created": "2026-04-22T02:15:05.410759+00:00", "updated": "2026-04-22T02:15:05.410771+00:00", "vendors": []}