← Database

CVE-2025-10684

MEDIUM CVSS: 4.3 Published: 2025-12-12 Modified: 2026-06-17

Description

The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .

Affected Platforms

Unknown

Weakness Type

CWE-287, CWE-352

References