CVE-2025-4322

CRITICAL EXPLOITED NUCLEI

Motors WordPress <5.6.67 - Privilege Escalation

Title source: llm

Description

The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.

Exploits (4)

nomisec SUSPICIOUS 2 stars
by IndominusRexes · poc
https://github.com/IndominusRexes/CVE-2025-4322-Exploit
nomisec SCANNER 1 stars
by Yucaerin · remote
https://github.com/Yucaerin/CVE-2025-4322
nomisec SCANNER
by gmh5225 · poc
https://github.com/gmh5225/Blackash-CVE-2025-4322

Nuclei Templates (1)

Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
CRITICALby DhiyaneshDK
FOFA: body="/wp-content/themes/motors/style.css"

References (2)

Scores

CVSS v3 9.8
EPSS 0.2645
EPSS Percentile 96.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Intel

VulnCheck KEV 2025-05-19

Classification

CWE
CWE-620
Status draft

Timeline

Published May 20, 2025
Tracked Since Feb 18, 2026