CVE-2025-10684CWE-287CWE-352csrf
CVE-2025-10684
Medium · published December 12, 2025
What it is
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
The record
Technical detail
- CVSS v3.1
- 4.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00119 · 1.7th percentile
- Weaknesses
- CWE-287 · Improper Authentication; CWE-352 · Cross-Site Request Forgery (CSRF)
- Published
- 2025-12-12T11:15Z
References (1)
EPSS history
Timeline