CVE-2025-3105: Vehica Core <= 1.0.97 - Authenticated (Subscriber+) Privilege Escalation
First published: Fri Apr 04 2025(Updated: )
The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 1.0.97. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change escalate their privileges to Administrator.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vehica Core plugin for WordPress | <=1.0.97 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3105?
CVE-2025-3105 has a severity rating that indicates a significant risk of privilege escalation in the Vehica Core plugin for WordPress.
How do I fix CVE-2025-3105?
To fix CVE-2025-3105, update the Vehica Core plugin for WordPress to the latest version beyond 1.0.97, ensuring proper user meta validation.
What versions of the Vehica Core plugin are affected by CVE-2025-3105?
All versions of the Vehica Core plugin for WordPress up to and including 1.0.97 are affected by CVE-2025-3105.
What type of vulnerability is CVE-2025-3105?
CVE-2025-3105 is classified as a privilege escalation vulnerability within the Vehica Core plugin for WordPress.
Who is impacted by CVE-2025-3105?
Users of the Vehica Core plugin for WordPress who have versions up to and including 1.0.97 are impacted by CVE-2025-3105.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/last-modified-date
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/vehica
- canonical/vehica core plugin for wordpress