CVE-2025-3603: Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Update
First published: Thu Apr 24 2025(Updated: )
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Flynax Bridge | <=2.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3603?
CVE-2025-3603 is considered a critical vulnerability due to its potential for privilege escalation via account takeover.
How do I fix CVE-2025-3603?
To mitigate CVE-2025-3603, update the Flynax Bridge plugin to version 2.2.1 or later, which addresses the vulnerability.
What versions of the Flynax Bridge plugin are affected by CVE-2025-3603?
All versions of the Flynax Bridge plugin up to and including 2.2.0 are affected by CVE-2025-3603.
What types of attacks can CVE-2025-3603 lead to?
CVE-2025-3603 can lead to unauthorized account access and privilege escalation for users.
How does CVE-2025-3603 occur?
CVE-2025-3603 occurs due to inadequate validation of a user's identity before allowing updates to their account details like passwords.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/flynax
- canonical/flynax bridge