CVE-2025-1564

critical · 9.8

The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a users identity through the social login. This makes it possible for unauthenticated attackers to log in as any user, including administrators and take over access to their account.

9.8

CVSS

0.5%

EPSS (exploit prob.)

45th

EPSS percentile

2025-03-01

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-288

References

https://themeforest.net/item/setsail-travel-agency-theme/22832625
https://www.wordfence.com/threat-intel/vulnerabilities/id/c2c2385e-0d1e-435a-9b82-972964084148?source=cve

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-1564