CVE-2025-10684: 
WordPress vulnerability analysis and mitigation

CVE-2025-10684 is an authorization bypass and CSRF vulnerability in the Construction Light WordPress theme that allows any authenticated user (e.g., subscriber-level) to activate arbitrary plugins. It affects all versions of the theme before 1.6.8 and was publicly disclosed on November 21, 2025, with NVD publication on December 12, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (WPScan, Red Hat CVE).

The root cause is a missing authorization check and absent CSRF token validation on an AJAX action handler (constructionlight_activate_plugin) registered in the theme (CWE-287: Improper Authentication; CWE-352: Cross-Site Request Forgery). Any authenticated WordPress user can send a crafted POST request to /wp-admin/admin-ajax.php?action=constructionlight_activate_plugin with a slug and file parameter specifying any installed plugin, triggering its activation without privilege verification. The only precondition is a valid WordPress session (subscriber role or higher) on a site running the vulnerable theme. The vulnerability was discovered and reported by researcher Khaled Alenazi (Nxploited), and a proof-of-concept request is publicly documented (WPScan).

Successful exploitation allows a low-privileged authenticated attacker to activate any installed but inactive WordPress plugin on the affected site, potentially enabling dormant malicious or vulnerable plugins that expand the attack surface. This could lead to further compromise depending on what plugins are installed — for example, activating a plugin with known vulnerabilities or one that grants elevated capabilities. The direct impact is limited to integrity (no confidentiality or availability impact), but the indirect risk of chained exploitation is significant (WPScan, Red Hat CVE).

A public proof-of-concept HTTP request is documented in the WPScan advisory, making exploitation straightforward for any authenticated user. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is 0.008% (0.000080), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan).

1. Reconnaissance: Identify WordPress sites using the Construction Light theme (versions before 1.6.8) via passive enumeration or tools like WPScan.
2. Obtain authenticated session: Register or log in as any low-privileged user (e.g., subscriber) on the target WordPress site.
3. Identify target plugin: Determine the slug and file path of an installed but inactive plugin on the target site (e.g., via error messages, public plugin directories, or prior reconnaissance).
4. Send malicious AJAX request: Issue the following POST request using the authenticated session cookie:

POST /wp-admin/admin-ajax.php?action=constructionlight_activate_plugin HTTP/1.1
Host: <target>
Cookie: <authenticated session>
Content-Type: application/x-www-form-urlencoded

slug=<plugin-slug>&file=<plugin-slug>

5. Achieve objective: The target plugin is activated without authorization, potentially enabling further exploitation through the newly activated plugin's functionality (WPScan).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php?action=constructionlight_activate_plugin from low-privileged user accounts; unexpected plugin activation events in the WordPress audit/activity log.
• WordPress State: Plugins that were previously inactive appearing as active without administrator action; review wp_options table for changes to the active_plugins option at unexpected times.
• Network: Repeated POST requests to the admin-ajax.php endpoint with the constructionlight_activate_plugin action parameter from non-administrative user sessions.

Update the Construction Light WordPress theme to version 1.6.8 or later, which introduces proper authorization and CSRF validation on the plugin activation AJAX action. As an interim workaround, site administrators can deactivate the Construction Light theme or restrict subscriber-level user registration if not required. Administrators should also audit currently active plugins to ensure no unauthorized activations have occurred (WPScan).

The vulnerability was discovered and responsibly disclosed by researcher Khaled Alenazi (Nxploited), who also submitted it to WPScan. Coverage has been limited to automated vulnerability tracking platforms and security feeds, with no notable broader media or community discussion identified (WPScan).