What is the CVSS score of CVE-2025-11522?

CVE-2025-11522 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WordPress are affected by CVE-2025-11522?

CVE-2025-11522 affects the Search & Go - Directory WordPress Theme (versions ≤2.7) and allows unauthenticated remote attackers to completely bypass authentication and assume administrator privileges…

How to fix or mitigate CVE-2025-11522?

Within 24 hours: Disable Facebook login functionality in Search & Go - Directory Theme settings or deactivate the theme entirely if Facebook login is in use. Within 7 days: Audit all user accounts and administrator access logs for unauthorized activity; reset administrator passwords and review access tokens. Within 30 days: Monitor the Search & Go - Directory Theme plugin repository for a patched version ≥2.8 and apply immediately upon release, or migrate to an alternative directory theme with current security support.

WordPress CVE-2025-11522

CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2025-10-09 security@wordfence.com

WordPress Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Oct 09, 2025 - 08:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user() function This makes it possible for unauthenticated attackers to gain access to other user's accounts, including administrators, when Facebook login is enabled. CVE-2025-62064 is likely a duplicate of this CVE.

AnalysisAI

Unauthenticated attackers bypass authentication and gain complete account access, including administrator privileges, in Search & Go - Directory WordPress Theme versions ≤2.7 when Facebook login functionality is enabled. Exploitation requires no user interaction and no authentication. The vulnerability stems from insufficient user validation in the search_and_go_elated_check_facebook_user() function, allowing arbitrary account takeover. No public exploit identified at time of analysis. This issue is remotely exploitable over the network with low attack complexity.

Technical ContextAI

CWE-288 authentication bypass caused by absent or inadequate user identity validation during Facebook OAuth callback processing. The search_and_go_elated_check_facebook_user() function fails to properly verify user ownership before establishing authenticated sessions, enabling attackers to impersonate arbitrary accounts by manipulating Facebook authentication flow parameters without cryptographic validation.

Affected ProductsAI

Search & Go - Directory WordPress Theme (vendor: Elated Themes), all versions through 2.7, when Facebook login feature is active. CPE data not available for this premium ThemeForest product. WordPress installations with this theme and enabled Facebook authentication module are vulnerable.

RemediationAI

No vendor-released patch identified at time of analysis. Primary mitigation: immediately disable Facebook login functionality in theme settings (Social Login options panel) until vendor releases version 2.8 or higher addressing CVE-2025-11522. For commercial support, contact theme vendor via ThemeForest marketplace at https://themeforest.net/item/search-go-modern-smart-directory-theme/15365040. Monitor Wordfence Threat Intelligence for patch availability updates at https://www.wordfence.com/threat-intel/vulnerabilities/id/da590a65-8728-4577-b6e4-ecebc2a2277d?source=cve. If Facebook authentication is business-critical, consider temporary theme replacement or implement Web Application Firewall rules blocking requests to search_and_go_elated_check_facebook_user() callback endpoints pending vendor resolution.