प्लेटफ़ॉर्म
wordpress
घटक
javo-core
में ठीक किया गया
3.0.1
CVE-2025-0177 is a critical privilege escalation vulnerability affecting the Javo Core plugin for WordPress. This flaw allows unauthenticated attackers to elevate their privileges to administrator level by simply creating a new user account. The vulnerability impacts versions 0 through 3.0.0.080 of the plugin. A patch is expected from the vendor.
The impact of this vulnerability is severe. An attacker exploiting CVE-2025-0177 can gain complete control over a WordPress site. This includes the ability to modify content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and potentially use the compromised site to launch further attacks against other systems. The ease of exploitation – requiring only account creation – significantly increases the risk of widespread compromise, particularly for sites with weak security practices.
This vulnerability is considered high risk due to its critical CVSS score and the ease of exploitation. Public proof-of-concept code is likely to emerge quickly, increasing the likelihood of widespread exploitation. Monitor security advisories and threat intelligence feeds for updates on exploitation activity. The vulnerability was publicly disclosed on 2025-03-08.
WordPress websites using the Javo Core plugin, particularly those with default or weak security configurations, are at significant risk. Shared hosting environments where multiple websites share the same server infrastructure are also vulnerable, as a compromise of one site could potentially lead to the compromise of others.
• wordpress / composer / npm:
wp plugin list | grep javo-core• wordpress / composer / npm:
wp plugin update javo-core --all• wordpress / composer / npm:
wp plugin status javo-core• wordpress / composer / npm:
wp user list --field=role• wordpress / composer / npm:
wp user search --role=administratordisclosure
एक्सप्लॉइट स्थिति
EPSS
0.73% (73% शतमक)
CISA SSVC
CVSS वेक्टर
The primary mitigation for CVE-2025-0177 is to upgrade to a patched version of the Javo Core plugin as soon as it becomes available. Until a patch is released, consider temporarily disabling user registration on the WordPress site to prevent attackers from creating administrator accounts. Implementing a Web Application Firewall (WAF) with rules to block suspicious account creation attempts can also provide a layer of defense. Regularly review user accounts and permissions to identify and remove any unauthorized administrator accounts.
Actualice el plugin Javo Core a una versión corregida. La vulnerabilidad permite a usuarios no autenticados asignar roles de administrador, por lo que es crucial aplicar la actualización para mitigar el riesgo de escalada de privilegios.
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2025-0177 is a critical vulnerability in the Javo Core WordPress plugin that allows unauthenticated attackers to gain administrator privileges by creating new user accounts, granting them full control over the website.
If you are using Javo Core plugin versions 0 through 3.0.0.080, you are potentially affected by this vulnerability. Check your plugin version and upgrade as soon as a patch is available.
The recommended fix is to upgrade to a patched version of the Javo Core plugin. Until a patch is released, disable user registration or implement a WAF to block suspicious account creation attempts.
While active exploitation is not yet confirmed, the vulnerability's critical severity and ease of exploitation suggest it is likely to be targeted soon. Monitor security advisories and threat intelligence feeds.
Refer to the Javo Core plugin's official website or WordPress plugin repository for the latest security advisory and patch information.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।