The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
References
Configurations
No configuration.
History
09 Jan 2026, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-352 CWE-287 |
12 Dec 2025, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
12 Dec 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-12 06:15
Updated : 2026-01-09 20:15
NVD link : CVE-2025-10684
Mitre link : CVE-2025-10684
CVE.ORG link : CVE-2025-10684
JSON object : View
Products Affected
No product.