Privilege Escalation Vulnerability in CubeWP - All-in-One Dynamic Content Framework Plugin for WordPress

CVE-2025-4315

What is CVE-2025-4315?

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level access and above to exploit the update_user_meta() function. This flaw enables these users to modify arbitrary user metadata, ultimately allowing them to elevate their privileges to that of an administrator. As such, users at lower access levels can gain unauthorized control over the site by manipulating user permissions, compromising the security of the entire WordPress environment.

References