CVE-2025-13029

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Unknown	Knowband Mobile App Builder	< 3.0.0

References

Timeline

Published: Dec 31, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-13036.1The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading t CVE-2025-130309.8All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An CVE-2025-130315.9The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high priv CVE-2025-130327.8Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflo CVE-2025-130337.5A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An at CVE-2025-130345.9When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the ser CVE-2025-130358.0The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the p CVE-2025-130369.2An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpo CVE-2025-13048.8The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and CVE-2025-130428.8Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption CVE-2025-130446.2IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a CVE-2025-130486.4The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's Nickname in