CVE-2025-10896 – This vulnerability allows authenticated WordPre... (How to Fix)

Q: What is the severity of CVE-2025-10896?

CVE-2025-10896 has a CVSS score of 8.8 (HIGH). This vulnerability allows authenticated WordPress users with subscriber-level access or higher to install arbitrary plugin packages from crafted URLs, bypassing security controls. Attackers can upload malicious plugins leading to remote code execution. All WordPress sites using affected Jewel Theme Recommended Plugins Library versions are vulnerable.

📋 TL;DR

This vulnerability allows authenticated WordPress users with subscriber-level access or higher to install arbitrary plugin packages from crafted URLs, bypassing security controls. Attackers can upload malicious plugins leading to remote code execution. All WordPress sites using affected Jewel Theme Recommended Plugins Library versions are vulnerable.

💻 Affected Systems

Products:

WordPress plugins using Jewel Theme Recommended Plugins Library

Versions: All versions up to and including 1.0.2.3

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with subscriber-level authenticated user access. Multiple plugins using this library are affected.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full site compromise via remote code execution, allowing attackers to deface websites, steal data, install backdoors, or pivot to other systems.

🟠

Likely Case

Attackers upload malicious plugins to gain administrative access, modify content, or deploy cryptocurrency miners.

🟢

If Mitigated

With proper access controls and monitoring, unauthorized plugin installations would be detected and blocked before execution.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once credentials are obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 1.0.2.3

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384308%40image-hover-effects-elementor-addon&new=3384308%40image-hover-effects-elementor-addon

Restart Required: No

Instructions:

1. Update all affected plugins to latest versions. 2. Verify plugins no longer use vulnerable library version. 3. Test site functionality after updates.

🔧 Temporary Workarounds

Remove vulnerable plugins

all

Temporarily disable or remove affected plugins until patches are available

wp plugin deactivate [plugin-name]
wp plugin delete [plugin-name]

Restrict user capabilities

all

Remove plugin installation capabilities from subscriber and other non-admin roles

wp role reset subscriber
wp cap remove subscriber install_plugins

🧯 If You Can't Patch

Implement web application firewall rules to block plugin installation requests from non-admin users
Enable strict file upload validation and monitoring for unauthorized plugin files

🔍 How to Verify

Check if Vulnerable:

Check if any installed plugins contain 'Jewel Theme Recommended Plugins Library' files with version 1.0.2.3 or earlier

Check Version:

wp plugin list --fields=name,version | grep -i jewel

Verify Fix Applied:

Verify plugin files no longer contain the vulnerable *_recommended_upgrade_plugin function or have proper capability checks

📡 Detection & Monitoring

Log Indicators:

Unauthorized plugin installation attempts
HTTP POST requests to plugin installation endpoints from non-admin users
Unexpected plugin activation events

Network Indicators:

Outbound connections to suspicious plugin repositories
Unusual file upload patterns to wp-content/plugins/

SIEM Query:

source="wordpress" AND (event="plugin_installed" OR event="plugin_activated") AND user_role!="administrator"

📊 Metadata

CVE ID: CVE-2025-10896

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-862

EPSS Score: 0.3% exploit probability (52.7th percentile)

Published: November 4, 2025

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-10896, you might also want to check these: