Description
The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This makes it possible for unauthenticated attackers to register accounts with arbitrary roles, including administrator, by manipulating the _buyent_classified_user_type parameter during the registration process, granting them complete control over the WordPress site.
Published: 2026-02-19
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The Buyent Classified plugin for WordPress, bundled with the Buyent theme, permits an attacker to create user accounts with arbitrary roles through the REST API because the _buyent_classified_user_type parameter is not validated. An unauthenticated attacker can register an account as administrator, giving full control over the WordPress site. This flaw is a privilege escalation vulnerability (CWE‑269) that can lead to comprehensive compromise of the site, including content management, plugin installation, and access to sensitive data.

Affected Systems

The issue impacts the Buyent Classified plugin for WordPress bundled with the Buyent theme in all releases up to and including version 1.0.7. Any WordPress installation that contains these versions of the plugin and theme is affected.

Risk and Exploitability

The CVSS score of 9.8 signals a critical level of severity. The EPSS score of less than 1% indicates a low current exploitation probability, yet the flaw is remote and unauthenticated, presenting a high risk to attackers. Although not listed in the CISA KEV catalog, the potential impact necessitates urgent remediation. An attacker can exploit the flaw by sending a crafted REST API request to the registration endpoint with a selected _buyent_classified_user_type value, bypassing role restrictions.

Generated by OpenCVE AI on April 21, 2026 at 00:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Buyent Classified plugin and the Buyent theme to a release newer than 1.0.7 where the role validation in the registration REST API is fixed.
  • If upgrading is not possible, block or delete the unauthenticated registration REST endpoint, or restrict the _buyent_classified_user_type parameter so only non-privileged roles can be assigned.
  • Review existing user accounts for any that were created with elevated roles; reset or reduce privileges of accounts that were incorrectly granted administrative rights.

Generated by OpenCVE AI on April 21, 2026 at 00:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 20 Feb 2026 01:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 19 Feb 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Scriptsbundle
Scriptsbundle buyent
Wordpress
Wordpress wordpress
Vendors & Products Scriptsbundle
Scriptsbundle buyent
Wordpress
Wordpress wordpress

Thu, 19 Feb 2026 05:00:00 +0000

Type Values Removed Values Added
Description The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This makes it possible for unauthenticated attackers to register accounts with arbitrary roles, including administrator, by manipulating the _buyent_classified_user_type parameter during the registration process, granting them complete control over the WordPress site.
Title Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Scriptsbundle Buyent
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:32:59.618Z

Reserved: 2025-12-01T20:07:37.511Z

Link: CVE-2025-13851

cve-icon Vulnrichment

Updated: 2026-02-19T21:24:09.579Z

cve-icon NVD

Status : Deferred

Published: 2026-02-19T07:17:33.437

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-13851

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T00:15:16Z

Weaknesses