What’s Vulnerable › Vulnerabilities
CVE-2025-10684: Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-12 · updated 2026-10-07
- Weakness: CWE-287
Description
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
Affected products
- Construction Light: before 1.6.8 — fixed in 1.6.8
How to fix
Upgrade to a fixed version: Construction Light 1.6.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-10684 or the next vulnerability affects your stack