CVE-2025-13680 Overview
CVE-2025-13680 is a privilege escalation vulnerability in the Tiger theme for WordPress, affecting all versions up to and including 101.2.1. The flaw stems from the theme exposing the $user->set_role() function to authenticated users without proper authorization checks. Authenticated attackers with Subscriber-level access or above can invoke this function to assign themselves the administrator role. The issue is categorized under CWE-269: Improper Privilege Management.
Critical Impact
Any authenticated user with Subscriber privileges or higher can escalate to full administrator, gaining complete control over the WordPress site, its content, and connected data.
Affected Products
- Tiger theme for WordPress, versions up to and including 101.2.1
- WordPress installations distributing the Tiger Social Network Theme from ThemeForest
- Sites permitting Subscriber-level registration where the Tiger theme is active
Discovery Timeline
- 2025-11-27 - CVE-2025-13680 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-13680
Vulnerability Analysis
The Tiger theme exposes a code path that calls the WordPress $user->set_role() method using user-supplied input. The theme accepts role assignment requests from authenticated sessions and applies them without verifying that the caller holds the promote_users or manage_options capability. As a result, any logged-in user can request elevation to the administrator role and have WordPress persist the new role assignment to the user meta table. Once elevated, the attacker gains the ability to install plugins, modify themes, execute PHP through the editor, and create additional privileged accounts.
Root Cause
The root cause is missing authorization enforcement around the role-mutation endpoint. WordPress provides capability checks such as current_user_can('promote_users') precisely to gate operations like role changes, but the Tiger theme invokes set_role() without applying these checks. The vulnerability also reflects an absent nonce verification pattern, leaving the role-change action callable from any authenticated context. See the Wordfence vulnerability disclosure for additional analysis.
Attack Vector
Exploitation requires a valid WordPress account at Subscriber level or above. The attacker authenticates, then issues an HTTP request to the vulnerable theme endpoint with a parameter that drives set_role() to the administrator value. The action completes server-side, persisting the elevated role to the database. No user interaction from administrators is required, and the attack is performed entirely over the network.
No verified proof-of-concept code has been published. The exploitation mechanism is described in the Wordfence advisory linked above.
Detection Methods for CVE-2025-13680
Indicators of Compromise
- Unexpected wp_capabilities user meta entries showing administrator for accounts that were created as Subscribers
- WordPress audit log entries showing role changes initiated by non-administrative users
- New administrator accounts created shortly after low-privilege account registration
- Plugin or theme installations performed by accounts that should not hold the install_plugins capability
Detection Strategies
- Query the wp_usermeta table for wp_capabilities values of administrator and correlate with user registration timestamps in wp_users
- Monitor HTTP request logs for POST traffic to Tiger theme endpoints originating from low-privilege session cookies
- Alert on WordPress set_user_role action hook firings outside of legitimate admin workflows
Monitoring Recommendations
- Forward WordPress application logs and webserver access logs to a centralized analytics platform for correlation
- Track creation and privilege changes of administrator accounts as high-priority events
- Establish a baseline of expected role-change activity and alert on deviations
How to Mitigate CVE-2025-13680
Immediate Actions Required
- Disable or remove the Tiger theme on any WordPress site running version 101.2.1 or earlier until a patched release is confirmed
- Audit all user accounts and demote any administrator accounts that cannot be tied to a legitimate provisioning event
- Disable open user registration or restrict registration to trusted email domains while the vulnerability remains unpatched
- Rotate credentials for all administrator accounts and review installed plugins and themes for unauthorized changes
Patch Information
No fixed version is identified in the NVD record at the time of publication. Site operators should consult the ThemeForest product page and the Wordfence advisory for updates from the theme author and apply any released patch immediately.
Workarounds
- Switch to an alternative theme until a fixed version of Tiger is released
- Place the site behind a web application firewall configured to block requests targeting Tiger theme role-modification endpoints
- Restrict access to /wp-admin and authenticated theme endpoints by IP allowlist where feasible
- Remove or block the Subscriber role from being assigned to untrusted registrants
# Example: locate and disable the Tiger theme via WP-CLI
wp theme list --status=active
wp theme activate twentytwentyfour
wp theme delete tiger
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
