Vulnerability · Published Mar 8, 2025 · Assigned by Wordfence
CVE-2025-0177Javo Core <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup
Critical 9.8
In plain English
A critical-severity privilege mismanagement in Javo Core from javothemes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| javothemes | Javo Core | 0 – through 3.0.0.080 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H