CVE-2025-8425 describes a critical privilege escalation vulnerability in the My WP Translate WordPress plugin, affecting all versions up to and including 1.1. This flaw, stemming from a missing capability check in the ajax_import_strings() function, allows authenticated attackers with Subscriber-level access to modify arbitrary WordPress options. The vulnerability carries a high CVSS score of 8.8, indicating a network-exploitable, low-complexity attack that can lead to complete compromise of confidentiality, integrity, and availability. While no active exploitation or public exploit code is currently reported, and community discussion is minimal, the potential for an attacker to elevate their privileges to administrator by enabling user registration and changing the default role poses a significant risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 1.1CPE match | cpe:2.3:a:mythemeshop:my_wp_translate:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.