CVE-2025-0181
Published: 11 February 2025
Summary
CVE-2025-0181 is a critical-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Themeforest (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-8 (Identification and Authentication (Non-organizational Users)).
Deeper analysis
CVE-2025-0181 is a privilege escalation vulnerability via account takeover in the WP Foodbakery plugin for WordPress, affecting all versions up to and including 4.8. The flaw stems from the plugin not properly validating a user's identity before setting the current user and their authentication cookie, as classified under CWE-288. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no privileges or user interaction required. Exploitation allows them to impersonate any target user, such as administrators, thereby gaining unauthorized access to the account and potentially full control over the affected WordPress site.
Advisories from Wordfence provide further details on the vulnerability at https://www.wordfence.com/threat-intel/vulnerabilities/id/d722ec8d-bfca-4da1-8eb0-8d33735c5e44?source=cve, while the plugin is hosted on ThemeForest at https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331. The CVE was published on 2025-02-11T07:15:29.827.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1530
Vulnerability details
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the plugin not properly validating a user's identity prior to setting the current user…
more
and their authentication cookie. This makes it possible for unauthenticated attackers to gain access to a target user's (e.g. administrators) account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables remote exploitation of public-facing WordPress app (T1190) to forge/set web auth cookies (T1606.001) and use them as alternate auth material for account impersonation (T1550.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the plugin's authentication bypass flaw, directly preventing exploitation of CVE-2025-0181.
Mandates enforcement of approved authorizations with proper user identity validation before setting sessions or cookies, countering the plugin's improper access granting.
Ensures unique identification and authentication for non-organizational users, blocking unauthenticated attackers from impersonating targets via the flawed plugin logic.