Tiger <= 101.2.1 - Unauthenticated Privilege Escalation

The impact of this vulnerability is severe. An attacker exploiting CVE-2025-13675 can gain full administrative control over the affected WordPress site. This includes the ability to modify content, install malicious plugins, create new user accounts with elevated privileges, and potentially access sensitive data stored within the WordPress database. The attacker could also use the compromised site to launch further attacks against other systems on the network, significantly expanding the blast radius. This vulnerability is particularly concerning given the widespread use of WordPress and the potential for automated exploitation targeting vulnerable Tiger theme installations.

Websites using the Tiger WordPress theme, particularly those with default configurations or limited security hardening, are at significant risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r 'paypal-submit.php' /var/www/html/

• wordpress / composer / npm:

wp plugin list | grep tiger

• wordpress / composer / npm:

wp plugin update tiger --all

• generic web: Check WordPress access logs for suspicious POST requests to /wp-login.php with parameters attempting to set the user role to 'administrator'.

1. 2025-11-27Disclosure

   disclosure

1. Reserviert2025-11-25
2. Veröffentlicht2025-11-27
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-13675 is to upgrade the Tiger WordPress theme to a version that includes the security fix. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider temporarily restricting user registration to known, trusted email domains. While not a complete solution, this can reduce the attack surface. Monitor WordPress access logs for suspicious registration attempts, particularly those using unusual email addresses or attempting to assign the 'administrator' role. Web Application Firewalls (WAFs) configured to block requests containing suspicious parameters related to user registration could also provide a layer of defense.