CVE Explorer

CVE-2025-9029

The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to missing authorization via the wdkit_handle_review_submission function in versions less than, or equal to, 1.2.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to submit feedback data to external services.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:eb6560d7147e1e3c47dd6f784e119d2ceb64b3bee8d6d9ceea8c1756eae89036

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder","vendor":"posimyththemes","versions":[{"lessThanOrEqual":"1.2.16","status":"affected","version":"0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:fcbb57c11a131afb4d02cf050a03a130f6359ce30073c0135bd3dd7cef76a53e · sha256:ad346b7acb04a65d… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:fcbb57c11a131afb4d02cf050a03a130f6359ce30073c0135bd3dd7cef76a53e · sha256:ad346b7acb04a65d… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:fcbb57c11a131afb4d02cf050a03a130f6359ce30073c0135bd3dd7cef76a53e · sha256:ad346b7acb04a65d… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"url":"https://plugins.trac.wordpress.org/browser/wdesignkit/tags/1.2.17/includes/admin/notices/class-wdkit-review-form.php#L117"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:fcbb57c11a131afb4d02cf050a03a130f6359ce30073c0135bd3dd7cef76a53e · sha256:ad346b7acb04a65d… · /containers/cna/references/1

{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e89f0699-42be-403a-8cdb-31e214a85851?source=cve"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:fcbb57c11a131afb4d02cf050a03a130f6359ce30073c0135bd3dd7cef76a53e · sha256:ad346b7acb04a65d… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer