CVE-2019-25738
9.8 CRITICALWordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify...
Published: 2026-06-04 · Last updated: 2026-06-04
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-306
Description
WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2019-25738
- [Other]http://wordpress.framework-y.com
- [Other]http://wordpress.framework-y.com/hybrid-composer/
- [Other]https://labs.sucuri.net/wptf-hybrid-composer-unauthenticated-arbitrary-options-update/
- [Other]https://www.exploit-db.com/exploits/47154
- [Other]https://www.vulncheck.com/advisories/wordpress-hybrid-composer-unauthenticated-settings-change
Related CVEs
Same CWE
- CVE-2026-46612 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (8.8 HIGH)
- CVE-2026-20253 — In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthen... (9.8 CRITICAL)
- CVE-2026-45567 — Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers (8.3 HIGH)
- CVE-2026-9045 — During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise... (7.8 HIGH)
- CVE-2026-8335 — A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT"...