Vulnerability · Published Dec 12, 2025 · Assigned by WPScan

CVE-2025-10684Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation

Medium 4.3

In plain English

A medium-severity improper authentication in Construction Light from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.1%top 98.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .

Affected products (as reported)

Vendor	Product	Versions
Unknown	Construction Light	0 – before 1.6.8

Weakness: CWE-287, CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/cfabf8b2-30a4-462f-996c-79888a439c09/ exploit, vdb-entry, technical-description