Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-1564
CVE-2025-1564:
WordPress vulnerability analysis and mitigation
Overview
The vulnerability (CVE-2025-1564) affects the SetSail Membership plugin version 1.0.3 and earlier, which is a WordPress plugin for travel agency websites. The vulnerability is classified as an Authentication Bypass via Account Takeover with a CVSS score of 9.8, indicating critical severity (THN Weekly Recap).
Technical details
The vulnerability is an authentication bypass that could lead to account takeover in SetSail Membership plugin versions 1.0.3 and earlier. The high CVSS score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) indicates that the vulnerability is network-accessible, requires low complexity to exploit, and needs no privileges or user interaction (THN Weekly Recap).
Impact
Given the critical CVSS score and the nature of the vulnerability being an authentication bypass, successful exploitation could allow attackers to take over user accounts without requiring valid credentials, potentially compromising the entire travel agency website's user base (THN Weekly Recap).
Mitigation and workarounds
The vulnerability was addressed in SetSail Membership version 1.1, as indicated in the theme's changelog. Users are advised to update to the latest version to protect against potential authentication bypass attacks (ThemeForest).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management