CVE-2025-0180: Privilege Escalation in WP Foodbakery

The impact of CVE-2025-0180 is severe. An attacker exploiting this vulnerability can bypass authentication and gain full administrative control over the affected WordPress site. This grants them the ability to modify content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and potentially compromise the entire server. The ease of exploitation – requiring only registration – significantly increases the risk of widespread attacks targeting sites using WP Foodbakery.

1. Reserved2025-01-02
2. Published2025-02-11
3. Modified2026-04-08
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-0180 is to immediately upgrade the WP Foodbakery plugin to a patched version. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting user registration to verified email addresses or implementing stricter user role assignment policies. While not a complete solution, these workarounds can reduce the attack surface. After upgrading, confirm the fix by attempting to register a new user without administrator privileges and verifying that the account is created with a standard user role.