CVE-2025-1687

The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation on the 'update_user_profile' function. This makes it possible for unauthenticated attackers to update the user email and password via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/8574708
• https://webtemplatemasters.com/cardealer/changelog/#v165
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6305b7be-8651-4028-a8cf-ea58b4977225?source=cve

Published

Feb 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1679Cross-site Scripting has been identified in Moxa’s Ethernet …4.8
• CVE-2025-1680An acceptance of extraneous untrusted data with trusted data…0
• CVE-2025-1681The Cardealer theme for WordPress is vulnerable to unauthori…5.4
• CVE-2025-1682The Cardealer theme for WordPress is vulnerable to privilege…8.8
• CVE-2025-1683Improper link resolution before file access in the Nomad mod…7.8
• CVE-2025-1686Versions of the package io.pebbletemplates:pebble from 0 and…4.9
• CVE-2025-1688Milestone Systems has discovered a security vulnerability in…5.5
• CVE-2025-1689The ThemeMakers PayPal Express Checkout plugin for WordPress…5.4
• CVE-2025-1690The ThemeMakers Stripe Checkout plugin for WordPress is vuln…5.4
• CVE-2025-1691The MongoDB Shell may be susceptible to control character in…6.5
• CVE-2025-1692The MongoDB Shell may be susceptible to control character in…8.8
• CVE-2025-1693The MongoDB Shell may be susceptible to control character in…6.8