Privilege Escalation Vulnerability in ifkooo One-Login by ifkooo
CVE-2025-23974

8.1HIGH

Key Information:

Vendor

WordPress
Status
One-login
Vendor
CVE Published:
9 June 2025

What is CVE-2025-23974?

The ifkooo One-Login product is susceptible to an incorrect privilege assignment vulnerability that allows attackers to escalate their privileges. This issue can enable unauthorized users to gain elevated access and perform actions that are typically restricted, potentially leading to misuse of sensitive information or functionalities. The vulnerability affects versions from n/a through 1.4. Users are advised to apply the necessary updates and mitigations to secure their systems.

Affected Version(s)

One-Login <= 1.4

References

https://patchstack.com/database/wordpress/plugin/one-logi...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HLog (Patchstack Alliance)
.
CVE-2025-23974 : Privilege Escalation Vulnerability in ifkooo One-Login by ifkooo