CVE-2025-10299
BaseFortify
Publication date: 2025-10-15
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hakik_zaman | wpbifrost | 1.0.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the WPBifröst – Instant Passwordless Temporary Login Links WordPress plugin, where a missing capability check on the ctl_create_link AJAX action allows authenticated users with Subscriber-level access or higher to escalate their privileges. Specifically, they can create new administrative user accounts and log in as those administrators, bypassing normal security controls. [1]
How can this vulnerability impact me? :
The vulnerability can have a severe impact by allowing low-privileged authenticated users to gain administrative access to the WordPress site. This can lead to full site compromise, including unauthorized changes, data theft, or disruption of services.
What immediate steps should I take to mitigate this vulnerability?
Immediately disable or remove the WPBifröst – Instant Passwordless Temporary Login Links plugin from your WordPress installation, as it has been temporarily closed and removed from download pending a full security review. Avoid using versions up to and including 1.0.7 until a secure update is released. Additionally, review your WordPress user accounts for any unauthorized administrative users created via this vulnerability and remove them. [1]