CVE-2025-5117

HIGH Year: 2025
CVSS v3 Score
8.8
High
Weakness Type
CWE-862
View all →

Vulnerability Description

The Property plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the use of the property_package_user_role metadata in versions 1.0.5 to 1.0.6. This makes it possible for authenticated attackers, with Author‐level access and above, to elevate their privileges to that of an administrator by creating a package post whose property_package_user_role is set to administrator and then submitting the PayPal registration form.

Related Vulnerabilities

CVE-2015-8840

HIGH
CVSS:8.8(High)

The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly ha...

CWE-8622015

CVE-2017-17665

HIGH
CVSS:8.8(High)

In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a m...

CWE-8622017

CVE-2017-2652

HIGH
CVSS:8.8(High)

It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Ove...

CWE-8622017

CVE-2017-5180

HIGH
CVSS:8.8(High)

Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users t...

CWE-8622017

CVE-2017-6369

HIGH
CVSS:8.8(High)

Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so.

CWE-8622017

CVE-2017-6565

HIGH
CVSS:8.8(High)

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload files to the server hosting the web service. ...

CWE-8622017