CVE-2025-13851: Buyent Classified Privilege Escalation

CVE-2025-13851 Overview

The Buyent Classified plugin for WordPress, bundled with the Buyent theme, contains a critical privilege escalation vulnerability in all versions up to and including 1.0.7. The vulnerability exists due to improper validation of user roles during the registration process via the REST API endpoint. Unauthenticated attackers can exploit this flaw by manipulating the _buyent_classified_user_type parameter during registration to create accounts with arbitrary roles, including administrator, thereby gaining complete control over the WordPress site.

Critical Impact

Unauthenticated attackers can register administrator accounts and take complete control of affected WordPress sites, leading to full site compromise, data theft, and potential malware distribution.

Affected Products

• Buyent Classified plugin for WordPress versions up to and including 1.0.7
• WordPress sites using the Buyent theme with bundled Buyent Classified plugin
• Any WordPress installation with the Buyent Classified plugin active

Discovery Timeline

• 2026-02-19 - CVE-2025-13851 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-13851

Vulnerability Analysis

This privilege escalation vulnerability stems from a fundamental access control failure in the Buyent Classified plugin's user registration functionality. The plugin exposes a REST API endpoint for user registration that accepts a _buyent_classified_user_type parameter to define the user's role. However, the endpoint fails to implement proper validation or restriction checks on this parameter, allowing any value—including administrative roles—to be specified by unauthenticated users.

The attack surface is significant because the vulnerability requires no authentication and can be exploited remotely over the network. A successful exploit grants the attacker full administrative access to the WordPress installation, enabling them to modify content, install malicious plugins, access sensitive data, create backdoors, or completely deface the website.

Root Cause

The root cause is classified as CWE-269 (Improper Privilege Management). The plugin developers failed to implement server-side validation of the user role parameter during the registration process. The REST API endpoint trusts client-supplied input for role assignment without verifying that the requesting user has the authority to create accounts with elevated privileges. This represents a classic broken access control vulnerability where authorization checks are either missing or improperly implemented.

Attack Vector

The attack is conducted remotely over the network by sending a crafted HTTP request to the plugin's REST API registration endpoint. An attacker identifies a WordPress site running the vulnerable Buyent Classified plugin, then sends a registration request with the _buyent_classified_user_type parameter set to an administrator role value. Upon successful exploitation, the attacker receives valid administrator credentials and can immediately log into the WordPress dashboard with full administrative privileges.

The exploitation process involves:

1. Identifying a target WordPress site using the Buyent Classified plugin
2. Crafting a POST request to the REST API registration endpoint
3. Including the _buyent_classified_user_type parameter with an administrator role value
4. Submitting arbitrary user credentials for the new administrator account
5. Logging in with the newly created administrator account

For detailed technical information, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-13851

Indicators of Compromise

• Unexpected administrator accounts appearing in the WordPress user database
• User registration activity with elevated role assignments in server logs
• REST API requests to the Buyent Classified registration endpoint with suspicious _buyent_classified_user_type values
• New users with administrator privileges created without legitimate admin action

Detection Strategies

• Monitor WordPress user creation events for accounts with administrator or elevated roles
• Implement Web Application Firewall (WAF) rules to detect and block suspicious REST API registration requests
• Review access logs for POST requests to Buyent Classified plugin REST endpoints
• Enable WordPress audit logging to track privilege changes and user creation events

Monitoring Recommendations

• Configure alerts for any new administrator account creation in WordPress
• Monitor REST API endpoints for unusual registration patterns or parameter manipulation
• Implement real-time log analysis for WordPress authentication and user management events
• Deploy endpoint detection solutions to identify post-exploitation activity on web servers

How to Mitigate CVE-2025-13851

Immediate Actions Required

• Audit all WordPress user accounts for unauthorized administrator or elevated-privilege users
• Disable the Buyent Classified plugin immediately if an updated version is not available
• Review access logs for evidence of exploitation attempts
• Reset credentials for all existing administrator accounts as a precaution

Patch Information

Check the ThemeForest Product Page for updated versions of the Buyent Classified plugin and Buyent theme that address this vulnerability. Users should update to the latest available version as soon as a patch is released by the vendor.

Workarounds

• Disable user registration functionality if not required for site operations
• Implement a Web Application Firewall (WAF) with rules to block requests containing the _buyent_classified_user_type parameter
• Use a WordPress security plugin to restrict REST API access to authenticated users only
• Consider temporarily deactivating the Buyent Classified plugin until a patched version is available

# Disable the Buyent Classified plugin via WP-CLI
wp plugin deactivate buyent-classified

# List all administrator users to audit for unauthorized accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# Delete any unauthorized administrator accounts (replace USER_ID with actual ID)
# wp user delete USER_ID --reassign=1