CVE-2025-10684

Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation

CVSS 4.3 MEDIUMEPSS 0.1%CWE-287 CWE-352

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

12 dez 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Produtos afetados

Unknown · Construction Light

Referências

https://wpscan.com/vulnerability/cfabf8b2-30a4-462f-996c-79888a439c09/