Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2025-10684

Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Construction Light

Default version status: unaffected

  • 0 to < 1.6.8affected

References