Privilege Escalation Vulnerability in Flynax Bridge Plugin for WordPress

CVE-2025-3604

What is CVE-2025-3604?

The Flynax Bridge plugin for WordPress has a vulnerability that allows unauthorized users to escalate their privileges through account takeover. This flaw arises from inadequate validation of user identities during the update process of user attributes, such as email addresses. An attacker can exploit this vulnerability to change the email addresses of any user, including administrators, without authentication. By doing so, they can reset the passwords associated with those accounts, potentially gaining full access to sensitive information and administrative controls.

References