What is the CVSS score of CVE-2025-10299?

CVE-2025-10299 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-10299?

WPBifröst WordPress plugin versions through 1.0.7 contains a privilege escalation vulnerability that allows any authenticated user-including low-privilege subscribers-to create administrator accounts…

How to fix or mitigate CVE-2025-10299?

Within 24 hours: Disable the WPBifröst plugin immediately via WordPress admin panel or SSH; audit all user accounts created in the past 90 days for unauthorized administrators. Within 7 days: Contact the plugin vendor for patch timeline; if no patch is released, evaluate alternative link management solutions or permanently remove the plugin and migrate any critical functionality. Within 30 days: Implement Web Application Firewall rules to block requests to the ctl_create_link AJAX handler; conduct full site security audit including user role review, access logs, and malware scanning.

WordPress CVE-2025-10299

HIGH

Missing Authorization (CWE-862)

2025-10-15 security@wordfence.com

Authentication Bypass WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Oct 15, 2025 - 09:15 nvd

HIGH 8.8

DescriptionCVE.org

The WPBifröst - Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctl_create_link AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts and subsequently log in as those.

AnalysisAI

WPBifröst WordPress plugin through version 1.0.7 allows low-privileged authenticated users to escalate to full administrative access. Subscribers and higher roles can exploit a missing capability check in the ctl_create_link AJAX handler to create new administrator accounts and immediately log in with full site control. With CVSS 8.8 (High) and EPSS data unavailable, severity is driven by the low privilege requirement (PR:L) and complete system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis, and not listed in CISA KEV, but the attack is trivially automatable once an attacker holds any authenticated role.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a classic privilege escalation pattern in WordPress plugin development. The WPBifröst plugin is designed to generate temporary login links for administrative access, but the ctl_create_link AJAX action fails to verify that the requesting user has sufficient privileges (such as manage_options capability) before creating new user accounts. WordPress AJAX handlers must explicitly check user capabilities using functions like current_user_can() before performing privileged operations. The plugin's intended functionality - creating temporary admin access - becomes a privilege escalation vector when any authenticated user (including the lowest-privilege Subscriber role) can invoke the account creation mechanism without authorization checks. The vulnerability affects the core authentication and access control subsystem of WordPress installations running this plugin.

Affected ProductsAI

WPBifröst - Instant Passwordless Temporary Login Links plugin (also known as create-temporary-login) for WordPress, all versions up to and including 1.0.7. The plugin is distributed through the official WordPress plugin repository at wordpress.org/plugins/create-temporary-login. Any WordPress installation running this plugin with at least one non-administrator authenticated user account is vulnerable to privilege escalation attacks. The vulnerability exists in the AJAX handler code responsible for generating temporary login links, affecting the core functionality of the plugin across all documented releases prior to remediation.

RemediationAI

Immediately update WPBifröst plugin to version 1.0.8 or later, which addresses the missing capability check vulnerability as documented in the WordPress plugin repository changeset 3379010 available at plugins.trac.wordpress.org. Site administrators should review user account creation logs for any suspicious administrative accounts created by lower-privileged users, particularly examining accounts created through the ctl_create_link AJAX action. As a temporary workaround if immediate patching is not possible, disable the plugin entirely and remove it from active WordPress installations until the update can be applied. After patching, conduct a full user account audit to identify and remove any unauthorized administrator accounts that may have been created during the vulnerability window. Consult the official Wordfence threat intelligence advisory at wordfence.com/threat-intel/vulnerabilities/id/50946bc7-8d31-4376-bdcc-de7aad700503 for additional detection and remediation guidance.