Privilege Escalation in Vehica Core Plugin for WordPress by Vehica

CVE-2025-3105

What is CVE-2025-3105?

The Vehica Core plugin, associated with the Vehica - Car Dealer & Listing WordPress Theme, is susceptible to a privilege escalation vulnerability due to inadequate validation of user meta fields during database updates. This flaw allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to that of an Administrator. The vulnerability impacts all versions of the plugin up to and including version 1.0.97, posing a significant security risk to WordPress sites utilizing this plugin.

References