Vulnerability Description
The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_settings' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the default user role.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/85
- https://webtemplatemasters.com/cardealer/changelog/#v165
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4e337281-f05e-486c-949
FAQ
What is CVE-2025-1682?
CVE-2025-1682 is a vulnerability with a CVSS score of 8.8 (HIGH). The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_settings' function. This makes it possible ...
How severe is CVE-2025-1682?
CVE-2025-1682 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-1682?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.