CVE-2025-1687

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation on the 'update_user_profile' function. This makes it possible for unauthenticated attackers to update the user email and password via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Feb 28, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-16885.5Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after thCVE-2025-16895.4The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in versCVE-2025-16905.4The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up CVE-2025-16916.5The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can CVE-2025-16928.8The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate CVE-2025-16936.8The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inCVE-2025-16955.3In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an incCVE-2025-16965.2A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information viCVE-2025-16977.8A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions priorCVE-2025-16982.8Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial oCVE-2025-16992.8An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access.CVE-2025-17007.0A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local atta