CVE-2025-2238CWE-269

Vikinger <= 1.9.30 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax'

High · published April 25, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
31.2
In the wild
Unconfirmed
What it is

The Vikinger theme for WordPress is vulnerable to privilege in all versions up to, and including, 1.9.30. This is due to insufficient user_meta restrictions in the 'vikinger_user_meta_update_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator-level.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00384 · 31.2th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-04-25T06:45Z
EPSS history
Timeline
  • 25 APR 06:45Z
    Vikinger <= 1.9.30 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax'
    cvelistv5