CVE-2025-13764: WP CarDealer <= 1.2.16 - Unauthenticated Privilege Escalation
The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WPCarDealerUser::processregister' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13764?
CVE-2025-13764 has a moderate severity rating due to the privilege escalation risk it poses.
How do I fix CVE-2025-13764?
To fix CVE-2025-13764, upgrade the WP CarDealer plugin to version 1.2.17 or later.
Who is affected by CVE-2025-13764?
All users of the WP CarDealer plugin for WordPress versions up to and including 1.2.16 are affected by CVE-2025-13764.
What causes CVE-2025-13764?
CVE-2025-13764 is caused by a lack of restrictions in the 'WP_CarDealer_User::process_register' function that allows users to register with inappropriate roles.
Is it possible to exploit CVE-2025-13764?
Yes, CVE-2025-13764 can be exploited by unauthorized users to gain elevated privileges within the WordPress site.