CVE-2025-13680: Privilege Escalation in Tiger WordPress Theme

Successful exploitation of CVE-2025-13680 grants an attacker complete administrative control over the WordPress website. This includes the ability to modify content, install malicious plugins, create new user accounts with elevated privileges, and potentially compromise the entire system. The attacker could exfiltrate sensitive data, deface the website, or use it as a launchpad for further attacks against other systems on the network. The ease of privilege escalation, requiring only Subscriber access, significantly broadens the potential attack surface.

1. Reserved2025-11-25
2. Published2025-11-27
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-13680 is to upgrade the Tiger WordPress theme to a patched version as soon as it becomes available. Until a patch is released, consider restricting user roles and permissions to minimize the potential impact of a successful attack. Implement a Web Application Firewall (WAF) with rules to detect and block attempts to manipulate user roles. Regularly review user accounts and permissions to identify any suspicious activity. Monitor WordPress logs for unusual role changes.