CVE-2025-13675: Privilege Escalation in Tiger WordPress Theme

The impact of this vulnerability is severe. An attacker exploiting CVE-2025-13675 can gain full administrative control over the affected WordPress site. This includes the ability to modify content, install malicious plugins, create new user accounts with elevated privileges, and potentially access sensitive data stored within the WordPress database. The attacker could also use the compromised site to launch further attacks against other systems on the network, significantly expanding the blast radius. This vulnerability is particularly concerning given the widespread use of WordPress and the potential for automated exploitation targeting vulnerable Tiger theme installations.

1. Reserved2025-11-25
2. Published2025-11-27
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-13675 is to upgrade the Tiger WordPress theme to a version that includes the security fix. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider temporarily restricting user registration to known, trusted email domains. While not a complete solution, this can reduce the attack surface. Monitor WordPress access logs for suspicious registration attempts, particularly those using unusual email addresses or attempting to assign the 'administrator' role. Web Application Firewalls (WAFs) configured to block requests containing suspicious parameters related to user registration could also provide a layer of defense.