CVE-2025-6994

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6994", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-01T21:35:42.219Z", "datePublished": "2025-08-06T03:41:01.031Z", "dateUpdated": "2026-04-08T17:23:56.955Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:56.955Z"}, "affected": [{"vendor": "SmartDataSoft", "product": "Reveal Listing", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'listing_user_role' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role."}], "title": "Reveal Listing <= 3.3 - Unauthenticated Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd00d716-535c-41eb-a766-82079e0060e6?source=cve"}, {"url": "https://themeforest.net/item/reveal-directory-listing-wordpress-theme/27704330"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Alyudin Nafiie"}], "timeline": [{"time": "2025-08-05T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-06T19:29:13.989687Z", "id": "CVE-2025-6994", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-06T19:29:22.342Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6994", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-06T19:29:13.989687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-06T19:29:18.550Z"}}], "cna": {"title": "Reveal Listing <= 3.3 - Unauthenticated Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Alyudin Nafiie"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "SmartDataSoft", "product": "Reveal Listing", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-05T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd00d716-535c-41eb-a766-82079e0060e6?source=cve"}, {"url": "https://themeforest.net/item/reveal-directory-listing-wordpress-theme/27704330"}], "descriptions": [{"lang": "en", "value": "The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'listing_user_role' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:56.955Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6994", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:23:56.955Z", "dateReserved": "2025-07-01T21:35:42.219Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-06T03:41:01.031Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Reveal Listing", "vendor": "SmartDataSoft", "versions": [{"lessThanOrEqual": "3.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'listing_user_role' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role."}, {"lang": "es", "value": "El complemento Reveal Listing by smartdatasoft para WordPress es vulnerable a la escalada de privilegios en versiones hasta la 3.3 incluida. Esto se debe a que el complemento permite a los usuarios que registran nuevas cuentas configurar su propio rol o proporcionar el campo 'listing_user_role'. Esto permite que atacantes no autenticados obtengan privilegios elevados creando una cuenta con el rol de administrador."}], "id": "CVE-2025-6994", "lastModified": "2026-06-17T10:03:00.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6994", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-06T19:29:13.989687Z", "version": "2.0.3"}}]}, "published": "2025-08-06T04:16:20.197", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/reveal-directory-listing-wordpress-theme/27704330"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd00d716-535c-41eb-a766-82079e0060e6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:59:20.000469+00:00", "value": {"mitigation_remediation": ["Update Reveal Listing to the latest version that removes the role selection parameter", "If unable to update immediately, disable public user registration or limit the registration role to a non\u2011privileged default", "Review user accounts for unexpected administrator entries and revoke any that were created with elevated privileges"], "summary": {"action": "Apply Patch", "impact": "Unauthenticated privilege escalation to administrator"}, "threat_synthesis": {"affected_systems": "SmartDataSoft\u2019s Reveal Listing WordPress theme is affected in all releases version 3.3 and earlier. WordPress sites that have the plugin installed and still allow open registration are susceptible. No other versions or products are listed.", "description_and_impact": "The vulnerability in Reveal Listing allows anyone who can register a new account to assign themselves the administrator role. This bypasses normal WordPress role restrictions and gives full control over the site, including changing themes, installing plugins, and accessing sensitive data. The weakness is an improper privilege management flaw, identified as CWE\u2011269.", "risk_and_exploitability": "The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1\u202f% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by simply submitting a registration request with the \"listing_user_role\" parameter set to an administrative role, requiring no credentials. Once the account is created, the attacker has full administrative privileges."}}}}, "created": "2025-08-06T08:12:48.079269+00:00", "updated": "2026-04-20T20:00:10.532716+00:00", "vendors": ["smartdatasoft", "smartdatasoft$PRODUCT$reveal_listing", "wordpress", "wordpress$PRODUCT$wordpress"]}