CVE-2025-10706

Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

Published Oct 16, 2025 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Framework plugin.

Analysis

Technical impact

Classified Pro, a WordPress theme, is vulnerable due to a missing capability check in the "cwp_addons_update_plugin_cb" function. Authenticated users with subscriber level access and higher can exploit this flaw to install arbitrary plugins on the site’s server. Installing such plugins can provide the attacker with remote code execution capabilities, enabling full compromise of the website.

Affected Systems

The vulnerability affects Cridio Studio’s ClassifiedPro reCommerce WordPress Theme in all releases up to and including version 1.0.14. Any site that has installed one of those versions is at risk.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity impact, while the EPSS score of < 1 % suggests that widespread exploitation is currently unlikely. This vulnerability is not yet listed in CISA’s KEV catalog. Attacking this flaw requires an authenticated session with at least subscriber permissions and knowledge of the nonce supplied by the CubeWP Framework plugin. Once the attacker gains plugin‑upload access, arbitrary code can be deployed on the server.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cridio Studio

ClassifiedPro - reCommerce WordPress Theme

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.14

No data.

Vendor	Product	Versions
Cridio Studio	Classifiedpro	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Classified Pro to the latest available version (1.0.15 or newer) to remove the missing capability check.
Remove or disable the CubeWP Framework plugin if it is not required, or restrict its use to trusted administrators.
Revoke or downgrade the capability that allows users to install plugins for subscriber roles and lower.
Apply stricter file‑system permissions so that only the web server user can write to plugin directories.
Audit the site’s plugin directory for recently added plugins and review their source.

Generated by OpenCVE AI on April 22, 2026 at 22:01 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.655% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://themeforest.net/item/classifiedpro-recommerce-classified-wordpress-theme/44528010
https://www.wordfence.com/threat-intel/vulnerabilities/id/2954583e-4ebe-4658-b132-0085f2b1cf08?source=cve

History

Oct 21, 2025 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cridio Studio Cridio Studio classifiedpro Wordpress Wordpress wordpress
Vendors & Products		Cridio Studio Cridio Studio classifiedpro Wordpress Wordpress wordpress

Oct 16, 2025 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 16, 2025 7:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Framework plugin.
Title		Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
Weaknesses		CWE-862
References		https://themeforest.net/item/classifiedpro-recommerce-classified-wordpress-theme/44528010 https://www.wordfence.com/threat-intel/vulnerabilities/id/2954583e-4ebe-4658-b132-0085f2b1cf08?source=cve
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`