CVE-2025-1671
Last modified
CVE-2025-1671 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academist_membership_check_facebook_user() function not properly verifying a user's identity prior to authenticating them. EPSS estimates a 0.52% chance of exploitation in the next 30 days.
Description
The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academist_membership_check_facebook_user() function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as any user, including site administrators.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-1671?
How severe is CVE-2025-1671?
How do I fix CVE-2025-1671?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-1665The Avada (Fusion) Builder plugin for WordPress is vulnerabl…5.4
- CVE-2025-1666The Cookie banner plugin for WordPress – Cookiebot CMP by Us…4.3
- CVE-2025-1667The School Management System – WPSchoolPress plugin for Word…4.3
- CVE-2025-1668The School Management System – WPSchoolPress plugin for Word…5.4
- CVE-2025-1669The School Management System – WPSchoolPress plugin for Word…6.5
- CVE-2025-1670The School Management System – WPSchoolPress plugin for Word…6.5
- CVE-2025-1672The Notibar – Notification Bar for WordPress plugin for Word…5.5
- CVE-2025-1673A malicious or malformed DNS packet without a payload can ca…8.2
- CVE-2025-1674A lack of input validation allows for out of bounds reads ca…8.2
- CVE-2025-1675The function dns_copy_qname in dns_pack.c performs performs …9.1
- CVE-2025-1676A vulnerability classified as critical was found in hzmanyun…9.8
- CVE-2025-1677A Denial of Service (DoS) issue has been discovered in GitLa…7.5
Are you affected by CVE-2025-1671?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST