CVE Daily

CVE-2025-6813

The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalatio...

High CVSS 8.8

Overview

The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass all role checks and gain full admin privileges.

CWE: CWE-862 Published: 2025-07-18T05:15:32.143
Risk analysis

This vulnerability is rated 🟠 HIGH.

  • CVSS: 8.8 (HIGH)
  • Detected tags: misconfiguration, priv_esc, wordpress (tag impact: HIGH)

Recommended actions:

  • Fix privilege escalation urgently.
  • Enforce least-privilege and strengthen EDR detection.

Recommended tools

Tags