V1Rustyle Flynax Bridge vulnerabilities
4 known vulnerabilities affecting v1rustyle/flynax_bridge.
Total CVEs
4
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH1MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2025-3604P2CRITICALCVSS 9.8≤ 2.2.02025-04-24
CVE-2025-3604 [CRITICAL] CWE-862 CVE-2025-3604: The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses,
nvd
CVE-2025-3603P2CRITICALCVSS 9.8≤ 2.2.02025-04-24
CVE-2025-3603 [CRITICAL] CWE-620 CVE-2025-3603: The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, in
nvd
CVE-2025-4179P3HIGHCVSS 7.3≤ 2.2.02025-05-02
CVE-2025-4179 [HIGH] CWE-862 CVE-2025-4179: The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missin
The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to register new user accounts as authors.
nvd
CVE-2025-4177P4MEDIUMCVSS 5.3≤ 2.2.02025-05-02
CVE-2025-4177 [MEDIUM] CWE-862 CVE-2025-4177: The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing c
The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary users.
nvd