CVE-2025-3604: Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover
First published: Thu Apr 24 2025(Updated: )
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Flynax Bridge | <=2.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3604?
CVE-2025-3604 is classified as a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2025-3604?
To fix CVE-2025-3604, you should update the Flynax Bridge plugin to version 2.2.1 or later.
What versions of Flynax Bridge are affected by CVE-2025-3604?
All versions of Flynax Bridge up to and including 2.2.0 are affected by CVE-2025-3604.
What type of attack does CVE-2025-3604 facilitate?
CVE-2025-3604 facilitates account takeover attacks through improper validation of user identity.
Who is impacted by CVE-2025-3604?
Users of the Flynax Bridge plugin for WordPress are impacted by CVE-2025-3604, particularly those using versions up to 2.2.0.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/flynax
- canonical/flynax bridge