Cyber Posture

CVE-2025-23504

Critical

Published: 08 January 2026

Published
08 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0010 27.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through <= 1.1.3.

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match
preventdetect

Directly mitigates authentication bypass via alternate path by explicitly identifying, authorizing, and monitoring actions permitted without identification or authentication.

SI-2 Flaw Remediation good match
prevent

Addresses the specific flaw in Felan Framework by requiring timely identification, reporting, and correction of vulnerabilities like this authentication bypass.

AC-3 Access Enforcement good match
prevent

Enforces approved access authorizations in the system, preventing unauthorized account takeover through alternate channels in the WordPress plugin.

Security SummaryAI

CVE-2025-23504 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the Felan Framework WordPress plugin developed by RiceTheme. This issue affects the felan-framework component in all versions from n/a through 1.1.3, enabling authentication abuse. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.

Unauthenticated remote attackers can exploit this vulnerability over the network without user interaction. Successful exploitation allows authentication abuse, leading to account takeover as detailed in associated advisories, with high impacts on confidentiality, integrity, and availability.

The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/felan-framework/vulnerability/wordpress-felan-framework-plugin-1-1-3-account-takeover-vulnerability?_s_id=cve) provides further details on the WordPress Felan Framework plugin 1.1.3 account takeover vulnerability, including potential mitigation and patch information.

Details

CWE(s)
CWE-288

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

CVE-2025-23504 is an authentication bypass in a public-facing WordPress plugin (T1190: Exploit Public-Facing Application), enabling unauthenticated account takeover for unauthorized access using valid accounts (T1078: Valid Accounts).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References