Cyber Resilience

CVE-2025-10915

Critical

Published: 13 January 2026

Published
13 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 19.0th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-10915 is a critical-severity an unspecified weakness vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-10915 is a high-severity vulnerability in the Dreamer Blog WordPress theme through version 1.2, stemming from a missing capability check that enables arbitrary installations. Published on 2026-01-13, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical risk due to its potential for widespread compromise.

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and without requiring user interaction (UI:N). Exploitation allows arbitrary installations, likely of plugins or themes, resulting in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially leading to full site takeover.

Mitigation details are available in the WPScan advisory at https://wpscan.com/vulnerability/dab3a804-9027-4b4a-b61c-61b562045bc4/. Security practitioners should update the Dreamer Blog theme beyond version 1.2 where possible and review WordPress installations using this theme.

EU & UK References

Vulnerability details

The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.

CWE(s)
None listed

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Missing capability check enables unauthenticated remote plugin/theme installation on public-facing WordPress site (T1190), directly facilitating web shell or malicious component deployment (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the vulnerability by requiring identification, reporting, and correction of the flaw in the Dreamer Blog theme through updates beyond version 1.2.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for access to system resources, directly addressing the missing capability check that allows unauthenticated arbitrary installations.

AC-6 Least Privilege good match
prevent

Implements the principle of least privilege to restrict unauthenticated remote attackers from performing installations in the WordPress theme.

References