CVE-2025-59134CWE-266

CVE-2025-59134

High · published December 18, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

⚡ A privilege escalation bug in Jthemes Sale! means anyone could potentially take on higher access, like a waiter who suddenly starts assigning tables! Imagine if a restaurant had no checks on who could reserve the best tables — suddenly, anyone could grab the corner booth just because they thought they deserved it. This flaw allows unauthorized users to escalate their privileges in the system, bypassing regular safeguards and taking control. An attacker could leverage this vulnerability to gain administrative access, allowing them to manipulate sensitive data, change configurations, or even lock out legitimate users. The potential fallout could be absolutely devastating, resulting in data breaches or unauthorized transactions that could harm the trust your clients place in your services.

Put simply

Imagine if a restaurant had no checks on who could reserve the best tables — suddenly, anyone could grab the corner booth just because they thought they deserved it. This flaw allows unauthorized users to escalate their privileges in the system, bypassing regular safeguards and taking control. This incorrect privilege assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting allows users to escalate their privileges beyond intended boundaries, affecting versions from n/a through 1.5.8.

What to do

An attacker could leverage this vulnerability to gain administrative access, allowing them to manipulate sensitive data, change configurations, or even lock out legitimate users. The potential fallout could be absolutely devastating, resulting in data breaches or unauthorized transactions that could harm the trust your clients place in your services. Update to the latest version of Jthemes Sale! to patch this vulnerability. Confirm that privilege checks are properly implemented to prevent unauthorized access. It's also a good idea to audit user roles and permissions to ensure everything is locked down! You've got this! With the right steps, you'll secure your system against this vulnerability! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.1th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-12-18T13:16Z
References (1)
EPSS history
Timeline
  • 18 DEC 07:21Z
    WordPress Sale! Immigration law, Visa services support, Migration Agent Consulting theme <= 1.5.8 - Privilege Escalation vulnerability
    cvelistv5