CVE-2025-10849 Overview
CVE-2025-10849 is a missing authorization vulnerability in the Felan Framework plugin for WordPress. The flaw affects all versions up to and including 1.1.4. The process_plugin_actions function is exposed through an AJAX action without a capability check. Unauthenticated attackers can send crafted requests to activate or deactivate arbitrary plugins on a vulnerable site. The weakness is tracked as CWE-862: Missing Authorization. This class of flaw is common in WordPress plugins that register AJAX handlers via wp_ajax_nopriv_ hooks without enforcing permission checks.
Critical Impact
Unauthenticated attackers can toggle plugin activation state remotely over the network, which can disable security plugins or enable dormant plugins that expose additional attack surface.
Affected Products
- Felan Framework plugin for WordPress, versions up to and including 1.1.4
- WordPress sites using the associated Felan Freelance Marketplace and Job Board theme
- Any WordPress installation where the vulnerable plugin is active
Discovery Timeline
- 2025-10-16 - CVE-2025-10849 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10849
Vulnerability Analysis
The Felan Framework plugin registers an AJAX handler that invokes the process_plugin_actions function. WordPress AJAX endpoints registered under the wp_ajax_nopriv_ prefix are reachable by unauthenticated visitors. The handler processes plugin activation and deactivation requests but does not verify whether the caller has the activate_plugins capability. It also does not validate a nonce to confirm request origin. Attackers can therefore submit HTTP POST requests to /wp-admin/admin-ajax.php that instruct WordPress to change the state of any installed plugin.
Root Cause
The root cause is a missing capability check inside the AJAX action handler. WordPress provides current_user_can() and check_ajax_referer() primitives to enforce authorization and request integrity. The vulnerable version of Felan Framework omits both controls before performing the privileged operation. The Wordfence vulnerability report documents the missing authorization pattern.
Attack Vector
Exploitation requires only network access to the target site. An attacker sends an unauthenticated POST request to the WordPress AJAX endpoint with the vulnerable action name and a target plugin slug. The server executes the plugin activation or deactivation without validating the caller. Disabling a security plugin such as a web application firewall or activating a vulnerable plugin already present on disk can serve as a stepping stone to further compromise. The EPSS probability is 0.295% at the 21st percentile as of 2026-07-14.
Detection Methods for CVE-2025-10849
Indicators of Compromise
- Unexpected entries in the WordPress active_plugins option or sudden plugin state changes recorded in the audit log
- POST requests to /wp-admin/admin-ajax.php referencing the Felan Framework plugin action from unauthenticated sessions
- Security plugins reporting themselves as deactivated without administrator action
- New file writes or configuration changes appearing shortly after a plugin toggle event
Detection Strategies
- Alert on HTTP POST requests to admin-ajax.php where the action parameter targets Felan Framework and no authenticated WordPress cookie is present
- Correlate WordPress activated_plugin and deactivated_plugin hook events with the originating source IP and user context
- Baseline the set of active plugins and trigger detections when the list changes outside of a maintenance window
Monitoring Recommendations
- Forward WordPress debug and audit logs to a centralized SIEM for retention and correlation
- Monitor web server access logs for anomalous request rates against admin-ajax.php
- Track integrity of the wp-content/plugins directory and the active_plugins database option
How to Mitigate CVE-2025-10849
Immediate Actions Required
- Update the Felan Framework plugin to a version later than 1.1.4 as soon as the vendor publishes a fixed release
- Audit the site for unauthorized plugin state changes and review recent administrator activity
- Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible
Patch Information
Refer to the Wordfence Vulnerability Report and the ThemeForest product page for vendor update notifications. Site administrators should apply any release above 1.1.4 that addresses the missing capability check on the process_plugin_actions handler.
Workarounds
- Deactivate the Felan Framework plugin until a patched version is installed
- Deploy a web application firewall rule that blocks unauthenticated requests to the vulnerable AJAX action
- Enforce IP allow-listing on /wp-admin/ and admin-ajax.php for administrative networks where operational constraints permit
# Example WAF rule concept to block unauthenticated calls to the vulnerable action
# (adjust action name to the exact value registered by the plugin)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1010849,msg:'Block Felan Framework process_plugin_actions'"
SecRule ARGS:action "@rx felan" \
"chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
