CVE-2025-4797: Golo WordPress Theme Privilege Escalation

CVE-2025-4797 Overview

CVE-2025-4797 is an authentication bypass vulnerability in the Golo - City Travel Guide WordPress theme affecting all versions up to and including 1.7.0. The theme fails to validate a user's identity before setting an authorization cookie. Unauthenticated attackers can log in as any user, including administrators, if they know the target email address. The flaw maps to [CWE-288: Authentication Bypass Using an Alternate Path or Channel]. CVE-2025-54725 is likely a duplicate of this issue.

Critical Impact
Unauthenticated remote attackers can take over administrator accounts on WordPress sites running the Golo theme using only a valid user email address.

Affected Products

Golo - City Travel Guide WordPress Theme, versions up to and including 1.7.0
WordPress installations distributing the theme via ThemeForest
Sites with active administrator accounts using known email addresses

Discovery Timeline

2025-06-03 - CVE-2025-4797 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-4797

Vulnerability Analysis

The Golo theme exposes an authentication routine that issues a WordPress authorization cookie without verifying the requester controls the target account. The handler accepts an email address as input and sets a logged-in session for the matching user. No password, one-time token, or out-of-band verification is required. Because WordPress administrator emails are frequently exposed through author archives, REST endpoints, and public profile pages, attackers can enumerate valid targets without elevated access.

Successful exploitation produces a full administrator session. From there, an attacker can install plugins, modify theme files, create persistent backdoor accounts, exfiltrate database contents, and pivot to the underlying host through PHP execution primitives available to WordPress administrators.

Root Cause

The root cause is missing identity verification in the theme's login flow. The code path that issues the authorization cookie trusts user-supplied input as proof of identity. This is a classic [CWE-288] pattern where an alternate authentication channel lacks the checks present on the primary login form.

Attack Vector

The attack is remote, unauthenticated, and requires no user interaction. An attacker sends a crafted HTTP request to the vulnerable endpoint with the target administrator's email address. The server responds with a valid WordPress authentication cookie. The attacker reuses that cookie to access /wp-admin/ with full privileges.

No verified public exploit code is available at this time. Technical details are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-4797

Indicators of Compromise

Unexpected administrator logins from unfamiliar IP addresses in wp-login and WordPress audit logs
Newly created administrator accounts or modified user roles in wp_users and wp_usermeta
Plugin or theme installations, file edits, or scheduled task changes not tied to legitimate maintenance
HTTP requests to theme-specific authentication endpoints carrying an email parameter from unauthenticated clients

Detection Strategies

Inspect web server access logs for POST or GET requests to Golo theme login handlers that include an email parameter and return a Set-Cookie: wordpress_logged_in_* header
Correlate session creation events with the originating request to flag cookies issued without a corresponding password authentication event
Alert on administrator session establishment from IP addresses or user agents not seen in baseline activity for that account

Monitoring Recommendations

Enable WordPress activity logging and forward events to a centralized SIEM for retention and correlation
Monitor for changes to wp-config.php, theme files, and the wp_options table where attackers commonly persist
Track outbound connections from the WordPress host to detect post-compromise command-and-control or data exfiltration

How to Mitigate CVE-2025-4797

Immediate Actions Required

Deactivate the Golo - City Travel Guide theme on all WordPress sites until a fixed version is confirmed available from the vendor
Force a password reset and invalidate all active sessions for every administrator and editor account
Audit the wp_users table for unauthorized accounts and review recent plugin, theme, and file modifications
Restrict /wp-admin/ access by IP allowlist at the web server or WAF layer while remediation is in progress

Patch Information

No vendor patch is referenced in the available CVE data. Site owners should check the ThemeForest Product Listing for updates beyond version 1.7.0 and validate any release notes against the Wordfence Vulnerability Report before re-enabling the theme.

Workarounds

Apply a web application firewall rule that blocks requests to the vulnerable theme authentication endpoint from unauthenticated sources
Enforce two-factor authentication for all WordPress administrator accounts to limit damage if an authorization cookie is issued
Remove or obscure administrator email addresses from public author archives, REST API responses, and comment metadata
Switch high-value sites to a different theme until the vendor confirms a fix

bash

# Example WAF rule (ModSecurity) blocking unauthenticated access to the theme login handler
SecRule REQUEST_URI "@rx /wp-content/themes/golo/.*(login|auth)" \
  "id:1004797,phase:1,deny,status:403,\
  msg:'CVE-2025-4797 Golo theme auth bypass attempt',\
  chain"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"