CVE-2025-3604
CRITICALFlynax Bridge < 2.2.0 - Unauthenticated Privilege Escalation via Email Update
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-3604. PoCs published by Nxploited, Boshe99.
AI-analyzed exploit summary This is a functional exploit for CVE-2025-3604, targeting the Flynax Bridge WordPress plugin (versions <= 2.2.0). It allows unauthenticated attackers to change the email of any user, including administrators, by sending a crafted POST request to the vulnerable endpoint.
Description
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Exploits (2)
This is a functional exploit for CVE-2025-3604, targeting the Flynax Bridge WordPress plugin (versions <= 2.2.0). It allows unauthenticated attackers to change the email of any user, including administrators, by sending a crafted POST request to the vulnerable endpoint.
The repository contains functional exploit code for CVE-2025-3604, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The exploit demonstrates the ability to upload a malicious file to a vulnerable target.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H