CVE-2025-1295

High

Published: 27 February 2025

Published

27 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0009 26.1th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1295 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Localhost:1337 (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of flaws in vulnerable plugins like Templines Elementor Helper Core to prevent privilege escalation exploitation.

AC-6 Least Privilege good match

prevent

Enforces least privilege to restrict Subscriber-level users from performing arbitrary user meta updates that escalate roles to Administrator.

AC-2 Account Management good match

prevent

Manages user accounts and roles to ensure only authorized privileges are assigned, directly countering improper privilege management in the plugin.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Direct privilege escalation via arbitrary user meta/role modification in authenticated WordPress context.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.7. This is due to allowing arbitrary user meta updates. This makes it possible for authenticated attackers, with Subscriber-level access…

and above, to update their role to Administrator. The vulnerability can only be exploited when the BuddyPress plugin is also installed and activated.

Deeper analysisAI

CVE-2025-1295 is a privilege escalation vulnerability affecting the Templines Elementor Helper Core plugin for WordPress in all versions up to and including 2.7. The flaw stems from the plugin allowing arbitrary user meta updates, which enables attackers to escalate their privileges. Exploitation requires the BuddyPress plugin to be installed and activated on the target WordPress site. The vulnerability is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-269 (Improper Privilege Management).

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By leveraging the arbitrary user meta update capability, they can modify their own user role to Administrator, granting full control over the WordPress site, including the ability to execute high-impact actions on confidentiality, integrity, and availability.

Advisories from sources like Wordfence detail the vulnerability and reference the specific code location in the plugin's youzify.php file at line 3082. No patch information is specified in available details, but security practitioners should update to a fixed version if available or disable the plugin until remediation, particularly on sites running BuddyPress.