WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation

The impact of CVE-2025-0180 is severe. An attacker exploiting this vulnerability can bypass authentication and gain full administrative control over the affected WordPress site. This grants them the ability to modify content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and potentially compromise the entire server. The ease of exploitation – requiring only registration – significantly increases the risk of widespread attacks targeting sites using WP Foodbakery.

Websites using the WP Foodbakery plugin, particularly those with open user registration enabled, are at significant risk. Shared hosting environments where plugin updates are not managed by the website owner are also especially vulnerable. Sites relying on WP Foodbakery for critical functionality or storing sensitive user data face the highest potential impact.

• wordpress / composer / npm:

grep -r 'update_user_meta' /var/www/html/wp-content/plugins/wp-foodbakery/

• wordpress / composer / npm:

wp plugin list --status=all | grep wp-foodbakery

• wordpress / composer / npm:

wp plugin update wp-foodbakery --all

1. 2025-02-11Disclosure

   disclosure

1. आरक्षित2025-01-02
2. प्रकाशित2025-02-11
3. संशोधित2026-04-08
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2025-0180 is to immediately upgrade the WP Foodbakery plugin to a patched version. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting user registration to verified email addresses or implementing stricter user role assignment policies. While not a complete solution, these workarounds can reduce the attack surface. After upgrading, confirm the fix by attempting to register a new user without administrator privileges and verifying that the account is created with a standard user role.