Privilege Escalation Vulnerability in WPBifröst Plugin by WordPress

CVE-2025-10299

What is CVE-2025-10299?

The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access or higher to create unauthorized administrative user accounts. This weakness arises from a missing capability check on the ctl_create_link AJAX action, which can be exploited to gain elevated privileges, potentially compromising the website's security.

References