CVE-2025-2815
HighSummary
Wtyczka Administrator Z dla WordPressa jest podatna na nieautoryzowaną modyfikację danych, co może prowadzić do eskalacji uprawnień z powodu braku sprawdzenia uprawnień w funkcji adminz_import_backup() we wszystkich wersjach do 2025.03.24. Umożliwia to uwierzytelnionym atakującym, posiadającym dostęp na poziomie Subskrybenta i wyżej, aktualizację dowolnych opcji na stronie WordPress.
Risk Assessment
Atakujący mogą zmienić domyślną rolę rejestracji na administratora oraz włączyć rejestrację użytkowników, co pozwala im uzyskać dostęp administracyjny do podatnej witryny. To stwarza poważne zagrożenie dla bezpieczeństwa organizacji.
Recommendation
Zaleca się aktualizację wtyczki Administrator Z do najnowszej wersji, aby usunąć tę podatność. Dodatkowo, warto przeprowadzić audyt uprawnień użytkowników oraz monitorować aktywność na stronie.
Related vulnerabilities
- CVE-2026-102425Critical
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.
- CVE-2023-54400Critical
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection techniques against the Microsoft SQL Server backend to extract, disclose, and modify database contents, with potential for further compromise of the underlying server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
- CVE-2026-22094Critical
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.
- CVE-2026-82973Critical
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.
- CVE-2026-7192Critical
A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a system reboot via a manipulated HTTP POST request directed at the endpoint '/js/common/do_cmd.js' endpoint containing an excessively long parameter, which overwrites the PC and RA registers.
- CVE-2026-100819Critical
Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- CVE-2026-100818Critical
Vulnerability allows sandbox escape due to use-after-free in the Widget: Gtk component. It was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
- CVE-2026-100811Critical
Vulnerability allows sandbox escape due to use-after-free in the DOM: Core & HTML component. It was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
- CVE-2026-100804Critical
Vulnerability allows sandbox escape due to use-after-free in the Preferences: Backend component. It was fixed in Firefox 157.
- CVE-2026-100800Critical
Vulnerability allows sandbox escape due to use-after-free in the Disability Access APIs component. It was fixed in Firefox ESR 153.4 and Firefox 157.
Original NVD description (English source)
The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26959 is a duplicate of this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS