CVE-2019-25738CWE-306

WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change

Critical · published June 4, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00347 · 27.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-06-04T13:22Z
EPSS history
Timeline
  • 04 JUN 13:22Z
    WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change
    cvelistv5