CVE-2025-1682 - Cardealer <= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation

Back Back to CVE browser

HIGH

Cardealer <= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation

Published Feb 27, 2025

8.8

HIGH

CVSS 3.1

EPSS 0.57%

Description

The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_settings' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the default user role.

Affected products

Vendor ThemeMakers Product Car Dealer Automotive WordPress Theme – Responsive Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.6.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ThemeMakers

Car Dealer Automotive WordPress Theme – Responsive

unaffected

Version	Status	Constraints
0	affected	<=1.6.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

Link	Providers	Tags
https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/8574708
https://webtemplatemasters.com/cardealer/changelog/#v165
https://www.wordfence.com/threat-intel/vulnerabilities/id/4e337281-f05e-486c-9491-161365af252a?source=cve