CVE-2025-13851
Privilege Escalation in Buyent Classified WordPress Plugin via REST API
Publication date: 2026-02-19
Last updated on: 2026-02-19
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| buyent | classified | to 1.0.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Buyent Classified plugin for WordPress, which is bundled with the Buyent theme, has a vulnerability in all versions up to and including 1.0.7. This vulnerability allows privilege escalation through the user registration process. Specifically, the plugin does not validate or restrict the user role during registration via its REST API endpoint.
An unauthenticated attacker can exploit this by manipulating the _buyent_classified_user_type parameter during registration to assign themselves any user role, including administrator. This grants the attacker complete control over the WordPress site.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an attacker to gain administrator-level access without authentication. With such access, the attacker can fully control the WordPress site.
- Modify, delete, or create content arbitrarily.
- Install malicious plugins or themes.
- Access sensitive user data stored on the site.
- Use the compromised site as a platform for further attacks.
- Disrupt website availability or functionality.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know