Access Control Flaw in Traveler Theme by ShineTheme
CVE-2025-63028

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Traveler
Vendor
CVE Published:
9 December 2025

What is CVE-2025-63028?

The Traveler Theme by ShineTheme contains a significant access control vulnerability that arises from improperly configured security levels, allowing unauthorized access to protected areas. This flaw affects all versions up to and including 3.2.6, potentially enabling attackers to exploit the theme's oversight and gain access to restricted functionalities.

Affected Version(s)

Traveler <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Theme/trave...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
JSON
.
CVE-2025-63028 : Access Control Flaw in Traveler Theme by ShineTheme