Critical severity · published Oct 9, 2025
CVE-2025-11522
Search & Go - Directory WordPress Theme <= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user() function This makes it possible for unauthenticated attackers to gain access to other user's accounts, including administrators, when Facebook login is enabled. CVE-2025-62064 is likely a duplicate of this CVE.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
Search & Go - Directory WordPress Theme · Elated-Themes
through 2.7 · source: vendor
Affected product
SG
Search & Go - Directory WordPress Theme
Elated-Themes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11522
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11522
themeforest.net
https://themeforest.net/item/search-go-modern-smart-directory-theme/15365040
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/da590a65-8728-4577-b6e4-ecebc2a2277d?source=cve