CVE-2025-10850
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue.
Analysis
Authentication bypass in Felan Framework WordPress plugin versions up to 1.1.4 enables unauthenticated attackers to impersonate any user account registered via Facebook or Google social login. Hardcoded passwords in fb_ajax_login_or_register and google_ajax_login_or_register functions allow complete account takeover of affected users without requiring credentials. Exploitable remotely without user interaction. CVSS 9.8 Critical severity. No public exploit identified at time of analysis.
Technical Context
CWE-798 hardcoded credentials vulnerability in social login handlers. Functions fb_ajax_login_or_register and google_ajax_login_or_register contain static password values that authenticate users registered through OAuth providers (Facebook/Google) if they never changed default credentials. PR:N in CVSS confirms unauthenticated remote exploitation vector with network attack complexity low.
Affected Products
Felan Framework plugin for WordPress versions 1.0.0 through 1.1.4. Specifically impacts user accounts created via Facebook or Google social authentication mechanisms within the Felan Freelance Marketplace theme ecosystem. Vendor: Felan/ThemeForest. No CPE assigned.
Remediation
No vendor-released patch identified at time of analysis for Felan Framework plugin version 1.1.4. Immediate mitigation: deactivate Felan Framework plugin and disable Facebook/Google social login functionality until vendor releases patched version. Force password resets for all users registered via social authentication. Monitor vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4c7656-544c-4f2f-a42f-264ac90e3b61?source=cve and ThemeForest product page https://themeforest.net/item/felan-freelance-marketplace-and-job-board-wordpress-theme/53612955 for security updates. Implement application-layer access controls to restrict administrative functions. Review authentication logs for unauthorized access attempts targeting social login accounts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today