CVE-2025-13675
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user...
Affects 0 products across 3 vendors.
Software does not properly assign, modify, track, or check privileges, allowing unauthorized elevation of access.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
The Tiger theme for WordPress is vulnerable to Privilege Escalation, allowing unauthenticated attackers to register with the 'administrator' role, gaining full control over the site.
BSID: BS-2025-GLOBAL-232765-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-13675?
What is the CVSS score for CVE-2025-13675?
Is CVE-2025-13675 actively exploited?
How do I remediate CVE-2025-13675?
What systems are affected by CVE-2025-13675?
| CVE ID | CVE-2025-13675 |
|---|---|
| BSID | BS-2025-GLOBAL-232765-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2025-11-27 |
| Last Modified | 2026-10-18 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Source: NIST NVD / MITRE CVE Database
The vulnerability exists in the 'paypal-submit.php' file, which does not restrict the user roles that can be assigned during registration. Attackers can exploit this by registering with the 'administrator' role, bypassing normal authentication and authorization mechanisms.
Exploitation Likelihood: CRITICAL
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | f6ad47d90d4c11046e73809527d07a6b908703b777dca327fb41da094ad57b78523358d253016bf3788863ee45d9adbb1a570dcece3dc14e4ca17015db7e5a58 |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →