What is the CVSS score of CVE-2025-10850?

CVE-2025-10850 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google are affected by CVE-2025-10850?

The Felan Framework WordPress plugin (versions ≤1.1.4) contains a critical authentication bypass allowing unauthenticated attackers to impersonate any user account authenticated via Facebook or…

How to fix or mitigate CVE-2025-10850?

Within 24 hours: Identify all WordPress installations running Felan Framework plugin and document affected versions via admin dashboard or wp-cli. Disable or uninstall the plugin immediately if version ≤1.1.4 is detected. Within 7 days: Audit access logs for CVE-2025-10850 exploitation patterns (unauthorized social login impersonation); reset passwords for all users who authenticate via Facebook/Google social login; review and revoke any suspicious API tokens or sessions. Within 30 days: Evaluate alternative social login plugins with active security maintenance; implement Web Application Firewall (WAF) rules blocking requests to affected fb_ajax_login_or_register and google_ajax_login_or_register endpoints if plugin removal is delayed.

Google CVE-2025-10850

CRITICAL

Use of Hard-coded Credentials (CWE-798)

2025-10-16 security@wordfence.com

Google WordPress Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Oct 16, 2025 - 07:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue.

AnalysisAI

Authentication bypass in Felan Framework WordPress plugin versions up to 1.1.4 enables unauthenticated attackers to impersonate any user account registered via Facebook or Google social login. Hardcoded passwords in fb_ajax_login_or_register and google_ajax_login_or_register functions allow complete account takeover of affected users without requiring credentials. Exploitable remotely without user interaction. CVSS 9.8 Critical severity. No public exploit identified at time of analysis.

Technical ContextAI

CWE-798 hardcoded credentials vulnerability in social login handlers. Functions fb_ajax_login_or_register and google_ajax_login_or_register contain static password values that authenticate users registered through OAuth providers (Facebook/Google) if they never changed default credentials. PR:N in CVSS confirms unauthenticated remote exploitation vector with network attack complexity low.

Affected ProductsAI

Felan Framework plugin for WordPress versions 1.0.0 through 1.1.4. Specifically impacts user accounts created via Facebook or Google social authentication mechanisms within the Felan Freelance Marketplace theme ecosystem. Vendor: Felan/ThemeForest. No CPE assigned.

RemediationAI

No vendor-released patch identified at time of analysis for Felan Framework plugin version 1.1.4. Immediate mitigation: deactivate Felan Framework plugin and disable Facebook/Google social login functionality until vendor releases patched version. Force password resets for all users registered via social authentication. Monitor vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4c7656-544c-4f2f-a42f-264ac90e3b61?source=cve and ThemeForest product page https://themeforest.net/item/felan-freelance-marketplace-and-job-board-wordpress-theme/53612955 for security updates. Implement application-layer access controls to restrict administrative functions. Review authentication logs for unauthorized access attempts targeting social login accounts.