by Kastro
Paper/Archive/CVE-2025-0180

CVE-2025-0180

Chimpstudio WP Foodbakery — WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.3.443 × 208.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.

Affected

ProductAffectedFixed inSource
WP Foodbakery≤ 4.7–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=cverefthemeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331