Unauthorized Data Modification Vulnerability in Felan Framework Plugin for WordPress

CVE-2025-10849

What is CVE-2025-10849?

The Felan Framework plugin for WordPress suffers from a vulnerability that permits unauthorized modification of data. This flaw arises from a missing capability check on the 'process_plugin_actions' function, which is invoked through an AJAX action. As a result, attackers without authentication can exploit this issue to activate or deactivate any plugins on the site, leading to potential unauthorized control over the installation.

References