CVE-2025-10850

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-108519.8A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=log CVE-2025-108536.1A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encod CVE-2025-108548.1The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path CVE-2025-108557.5Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows Exploitation of Trust CVE-2025-108568.1Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection CVE-2025-108579.8A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. Affected by this issue is some unknown functionality of the f CVE-2025-108587.5An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthe CVE-2025-108594.0Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private CVE-2025-10865.3A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown CVE-2025-108617.5The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to CVE-2025-108627.5The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to CVE-2025-108657.8Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to ca