Themes Vulnerabilities

Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation

Description

The theme does not have authorisation and CSRF when activating plugins via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary plugins.

Proof of Concept

Affects Themes

construction-light
Fixed in 1.6.8

References

CVE
CVE-2025-10684

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Khaled Alenazi (Nxploited)
Submitter
Khaled Alenazi (Nxploited)
Verified
Yes
WPVDB ID
cfabf8b2-30a4-462f-996c-79888a439c09

Timeline

Publicly Published
2025-11-21 (about 1 month ago)
Added
2025-11-21 (about 1 month ago)
Last Updated
2025-11-21 (about 1 month ago)

Other

Published
Title
Published
2020-02-05
Title
Merge + Minify + Refresh < 1.10.8 - Authenticated Arbitrary File Delete
Published
2024-11-27
Title
Contest Gallery < 24.0.8 - Unauthenticated Arbitrary Password Reset
Published
2014-08-01
Title
WordPress 2.0 - 3.0 Remote Authenticated Administrator Add Action Bypass
Published
2024-12-05
Title
Login With OTP < 1.5 - Authentication Bypass via Weak OTP
Published
2021-12-14
Title
All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation