Privilege Escalation Vulnerability in Cardealer Theme by WordPress

CVE-2025-1682

What is CVE-2025-1682?

The Cardealer theme for WordPress is susceptible to a privilege escalation vulnerability due to a missing capability check in the 'save_settings' function. This issue affects authenticated users with subscriber-level access and above, allowing them to change the default user role. Websites utilizing the affected theme versions up to and including 1.6.4 may face potential unauthorized modifications, emphasizing the need for immediate updates to ensure robust security.

References