Vulnerability · Published Feb 11, 2025 · Assigned by Wordfence
CVE-2025-0180WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation
Critical 9.8
In plain English
A critical-severity privilege mismanagement in WP Foodbakery from Chimpstudio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 55.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Chimpstudio | WP Foodbakery | 0 – through 4.7 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H