CVE-2025-13764: 
WordPress vulnerability analysis and mitigation

CVE-2025-13764 is a critical privilege escalation vulnerability in the WP CarDealer plugin for WordPress, affecting all versions up to and including 1.2.16. The flaw allows unauthenticated attackers to register as an administrator by supplying the 'administrator' role during the user registration process. It was published on December 11, 2025, and assigned a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, Red Hat CVE).

The root cause is improper privilege management (CWE-269) in the WP_CarDealer_User::process_register function, which fails to validate or restrict the user role supplied during registration. An unauthenticated attacker can craft a registration request that includes role=administrator (or equivalent parameter), bypassing any server-side role restriction. No authentication, special configuration, or user interaction is required, making this a network-exploitable, low-complexity vulnerability (Wordfence, ENISA EUVD).

Successful exploitation grants an attacker full administrator access to the affected WordPress site without any prior authentication. This enables complete site takeover, including modifying content and settings, installing malicious plugins or themes, creating additional administrator accounts, accessing sensitive site data, and potentially pivoting to the underlying server infrastructure (Wordfence, ENISA EUVD).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.074%, reflecting a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the WP CarDealer plugin (version ≤ 1.2.16) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Locate registration endpoint: Navigate to the site's user registration page or identify the AJAX/form endpoint handled by WP_CarDealer_User::process_register.
3. Craft malicious registration request: Submit a registration form or HTTP POST request that includes a role parameter set to administrator (e.g., role=administrator) alongside standard registration fields such as username, email, and password.
4. Gain administrator access: Log in with the newly registered account, which will have full WordPress administrator privileges, enabling complete site control (Wordfence).

• Logs: WordPress authentication logs showing newly created user accounts with the administrator role registered via the WP CarDealer registration form; unexpected admin account creation entries in wp_users and wp_usermeta database tables.
• File System: Newly installed or modified plugins/themes not authorized by legitimate administrators; presence of web shells or backdoor files in the WordPress installation directory.
• Network: Unusual POST requests to the WP CarDealer registration endpoint containing a role=administrator parameter from external IP addresses.
• Process/Behavior: Unexpected changes to WordPress site settings, new administrator accounts with unfamiliar usernames or email addresses, or newly activated plugins/themes not recognized by site owners (Wordfence).

Site administrators should immediately update the WP CarDealer plugin to a version beyond 1.2.16, which contains the fix for this vulnerability. As an interim measure, consider temporarily deactivating the plugin if an update is not immediately available, and implement a web application firewall (WAF) rule to block registration requests containing role escalation parameters. Additionally, audit all recently created user accounts for unauthorized administrator registrations and remove any suspicious accounts (Wordfence, ENISA EUVD).

The vulnerability was reported and disclosed by Wordfence, which included it in their weekly WordPress vulnerability report for December 8–14, 2025 (Wordfence Weekly Report). It was also referenced in the CISA vulnerability bulletin for the relevant week (CISA Bulletin). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregation has been observed.