CVE-2025-23504CWE-288

CVE-2025-23504

Critical · published January 8, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

🚨 An authentication bypass vulnerability in RiceTheme's Felan Framework could let attackers slip right through the front door! 🔥 Think of it like a VIP event where someone finds a side entrance that nobody’s checking—suddenly, they’re mingling with the guests without an invitation! 🕵️‍♂️ If exploited, an attacker could gain unauthorized access to the system, potentially compromising sensitive data and user accounts. This could lead to a catastrophic security breach, impacting your entire user base and reputation.

Put simply

Think of it like a VIP event where someone finds a side entrance that nobody’s checking—suddenly, they’re mingling with the guests without an invitation! 🕵️‍♂️ This vulnerability allows authentication abuse by redirecting users through an alternate path or channel, bypassing normal authentication checks. It affects Felan Framework versions up to 1.1.3, making it a critical issue for those still using outdated versions.

What to do

If exploited, an attacker could gain unauthorized access to the system, potentially compromising sensitive data and user accounts. This could lead to a catastrophic security breach, impacting your entire user base and reputation. Immediately upgrade the Felan Framework to version 1.1.4 or later to patch this vulnerability. Additionally, review your authentication processes and ensure that only authorized channels are in use. Regularly audit access points to maintain security. You've got this! By taking action now, you can thwart potential threats and keep your system secure! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00492 · 41.3th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-01-08T15:15Z
References (1)
EPSS history
Timeline
  • 08 JAN 09:17Z
    WordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerability
    cvelistv5