CVE-2025-13851

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13851", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-01T20:07:37.511Z", "datePublished": "2026-02-19T04:36:27.334Z", "dateUpdated": "2026-04-08T17:32:59.618Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:59.618Z"}, "affected": [{"vendor": "scriptsbundle", "product": "Buyent", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This makes it possible for unauthenticated attackers to register accounts with arbitrary roles, including administrator, by manipulating the _buyent_classified_user_type parameter during the registration process, granting them complete control over the WordPress site."}], "title": "Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e618cf-dd77-45a7-ab57-5732fd329883?source=cve"}, {"url": "https://themeforest.net/item/buyent-classified-wordpress-theme/32588790"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ismail Syaleh"}], "timeline": [{"time": "2026-02-18T15:39:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T21:24:01.264002Z", "id": "CVE-2025-13851", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:24:16.175Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13851", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-19T21:24:01.264002Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:24:09.579Z"}}], "cna": {"title": "Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration", "credits": [{"lang": "en", "type": "finder", "value": "Ismail Syaleh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "scriptsbundle", "product": "Buyent", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T15:39:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e618cf-dd77-45a7-ab57-5732fd329883?source=cve"}, {"url": "https://themeforest.net/item/buyent-classified-wordpress-theme/32588790"}], "descriptions": [{"lang": "en", "value": "The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This makes it possible for unauthenticated attackers to register accounts with arbitrary roles, including administrator, by manipulating the _buyent_classified_user_type parameter during the registration process, granting them complete control over the WordPress site."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:59.618Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13851", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:59.618Z", "dateReserved": "2025-12-01T20:07:37.511Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:27.334Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Buyent", "vendor": "scriptsbundle", "versions": [{"lessThanOrEqual": "1.0.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This makes it possible for unauthenticated attackers to register accounts with arbitrary roles, including administrator, by manipulating the _buyent_classified_user_type parameter during the registration process, granting them complete control over the WordPress site."}, {"lang": "es", "value": "El plugin Buyent Classified para WordPress (incluido con el tema Buyent) es vulnerable a la escalada de privilegios a trav\u00e9s del registro de usuarios en todas las versiones hasta la 1.0.7, inclusive. Esto se debe a que el plugin no valida ni restringe el rol de usuario durante el registro a trav\u00e9s del endpoint de la API REST. Esto hace posible que atacantes no autenticados registren cuentas con roles arbitrarios, incluido el de administrador, manipulando el par\u00e1metro _buyent_classified_user_type durante el proceso de registro, otorg\u00e1ndoles control total sobre el sitio de WordPress."}], "id": "CVE-2025-13851", "lastModified": "2026-06-17T08:34:52.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13851", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T21:24:01.264002Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:33.437", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/buyent-classified-wordpress-theme/32588790"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e618cf-dd77-45a7-ab57-5732fd329883?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Buyent", "source": "cna", "vendor": "scriptsbundle"}, "product": "buyent", "vendor": "scriptsbundle"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-21T00:09:09.696110+00:00", "value": {"mitigation_remediation": ["Upgrade the Buyent Classified plugin and the Buyent theme to a release newer than 1.0.7 where the role validation in the registration REST API is fixed.", "If upgrading is not possible, block or delete the unauthenticated registration REST endpoint, or restrict the _buyent_classified_user_type parameter so only non-privileged roles can be assigned.", "Review existing user accounts for any that were created with elevated roles; reset or reduce privileges of accounts that were incorrectly granted administrative rights."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The issue impacts the Buyent Classified plugin for WordPress bundled with the Buyent theme in all releases up to and including version 1.0.7. Any WordPress installation that contains these versions of the plugin and theme is affected.", "description_and_impact": "The Buyent Classified plugin for WordPress, bundled with the Buyent theme, permits an attacker to create user accounts with arbitrary roles through the REST API because the _buyent_classified_user_type parameter is not validated. An unauthenticated attacker can register an account as administrator, giving full control over the WordPress site. This flaw is a privilege escalation vulnerability (CWE\u2011269) that can lead to comprehensive compromise of the site, including content management, plugin installation, and access to sensitive data.", "risk_and_exploitability": "The CVSS score of 9.8 signals a critical level of severity. The EPSS score of less than 1% indicates a low current exploitation probability, yet the flaw is remote and unauthenticated, presenting a high risk to attackers. Although not listed in the CISA KEV catalog, the potential impact necessitates urgent remediation. An attacker can exploit the flaw by sending a crafted REST API request to the registration endpoint with a selected _buyent_classified_user_type value, bypassing role restrictions."}}}}, "created": "2026-02-19T10:06:47.928585+00:00", "updated": "2026-04-21T00:15:16.125839+00:00", "vendors": ["scriptsbundle", "scriptsbundle$PRODUCT$buyent", "wordpress", "wordpress$PRODUCT$wordpress"]}