CVE-2025-3604

CRITICAL

Flynax Bridge < 2.2.0 - Missing Authorization

Title source: rule

Description

The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

Exploits (2)

nomisec WORKING POC 1 stars
by Nxploited · poc
https://github.com/Nxploited/CVE-2025-3604
github WORKING POC
by Boshe99 · pythonpoc
https://github.com/Boshe99/CVE-Exploits/tree/main/CVE-2025-3604

References (3)

Scores

CVSS v3 9.8
EPSS 0.0079
EPSS Percentile 74.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-862
Status published
Products (2)
flynax/flynax_bridge < 2.2.0
v1rustyle/Flynax Bridge < 2.2.0
Published Apr 24, 2025
Tracked Since Feb 18, 2026