{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13764", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-27T14:39:42.818Z", "datePublished": "2025-12-11T01:55:33.057Z", "dateUpdated": "2026-04-08T17:33:10.087Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:10.087Z"}, "affected": [{"vendor": "ApusTheme", "product": "WP CarDealer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site."}], "title": "WP CarDealer <= 1.2.16 - Unauthenticated Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f4893d9c-e039-43df-80b9-dbe42374caed?source=cve"}, {"url": "https://themeforest.net/item/boxcar-automotive-car-dealer-wordpress-theme/49741717"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "timeline": [{"time": "2025-12-02T13:54:42.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-10T12:04:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-11T15:34:07.461860Z", "id": "CVE-2025-13764", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T15:34:12.949Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13764", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-11T15:34:07.461860Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T15:34:10.074Z"}}], "cna": {"title": "WP CarDealer <= 1.2.16 - Unauthenticated Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "ApusTheme", "product": "WP CarDealer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.16"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-02T13:54:42.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-10T12:04:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f4893d9c-e039-43df-80b9-dbe42374caed?source=cve"}, {"url": "https://themeforest.net/item/boxcar-automotive-car-dealer-wordpress-theme/49741717"}], "descriptions": [{"lang": "en", "value": "The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:10.087Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13764", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:33:10.087Z", "dateReserved": "2025-11-27T14:39:42.818Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-11T01:55:33.057Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site."}], "id": "CVE-2025-13764", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-11T03:15:57.967", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/boxcar-automotive-car-dealer-wordpress-theme/49741717"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f4893d9c-e039-43df-80b9-dbe42374caed?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:32:19.899203+00:00", "value": {"mitigation_remediation": ["Upgrade ApusTheme WP CarDealer to a version newer than 1.2.16.", "If an upgrade is not immediately possible, block or remove the ability to register new users until a fix is applied.", "Implement role validation in the registration handler to reject the administrator role for unauthenticated requests."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation to Administrator"}, "threat_synthesis": {"affected_systems": "The issue affects the ApusTheme WP CarDealer plugin for WordPress. All releases up to and including version 1.2.16 are vulnerable. Sites running any of these versions are susceptible unless a newer, patched version is installed.", "description_and_impact": "The WP CarDealer WordPress plugin fails to limit the role that can be assigned during the registration process. This flaw allows anyone, even without logging in, to submit a registration request with the administrator role and thereby obtain full site access. As a result, an attacker could gain complete control over the WordPress installation, read or modify content, change settings, or add malicious plugins.", "risk_and_exploitability": "The flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score is under 1%, showing that exploitation probability is low, and the vulnerability is currently not listed in CISA's KEV. Nonetheless, the unauthenticated nature of the attack vector means anyone can trigger it by forging a registration request. Once exploited, the attacker gains administrator privileges, leading to full compromise of the site."}}}}, "created": "2025-12-11T15:16:10.455622+00:00", "updated": "2026-04-20T21:45:18.954192+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}