CVE-2025-3604

CVE-2025-3604 describes a critical privilege escalation vulnerability affecting all versions up to and including 2.2.0 of the Flynax Bridge plugin for WordPress. The flaw stems from insufficient identity validation, allowing unauthenticated attackers to alter user email addresses, including administrators. This enables attackers to reset passwords and seize control of accounts, leading to a complete compromise of the affected WordPress site. The vulnerability carries a CVSS score of 9.8 (Critical), indicating an easily exploitable attack vector (network-based, low complexity, no privileges or user interaction required) with high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation (not in KEV or Hot List), the high FAUCET Risk Score of 95/100 and significant community discussion (10 mentions) suggest a strong potential for future exploitation. No public exploit code (Metasploit, Nuclei, ExploitDB) is currently available.