CVE-2025-13029

Knowband Mobile App Builder for wooCommerce < 3.0.0 – Unauthenticated Arbitrary User Deletion

CVSS 7.5 HIGHEPSS 0.2%

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

31 dez 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Produtos afetados

Unknown · Knowband Mobile App Builder

Referências

https://wpscan.com/vulnerability/22344534-cd36-4817-b683-c0af55759e01/