Critical severity · published Sep 6, 2025
CVE-2025-8359
AdForest <= 6.0.9 - Authentication Bypass to Admin
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, including administrators, without access to a password.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
AdForest · scriptsbundle
through 6.0.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8359
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8359
themeforest.net
https://themeforest.net/item/adforest-classified-wordpress-theme/19481695
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/c080df50-1113-484b-80ed-09515982c585?source=cve
More from AdForest
9.8
CVE-2026-1729
AdForest <= 6.0.12 - Authentication Bypass
9.8
CVE-2024-12857
AdForest <= 5.1.8 - Authentication Bypass
9.8
CVE-2024-11350
AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover
9.8
CVE-2024-11349
AdForest <= 5.1.6 - Authentication Bypass
8.1
CVE-2025-67946
WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability