What’s Vulnerable › Vulnerabilities

CVE-2025-5060: Bravis User <= 1.0.1 - Authentication Bypass to Account Takeover

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-23 · updated 2026-06-17
• Weakness: CWE-288

Description

The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly logging a user in with the data that was previously verified through the facebook_ajax_login_callback(). This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site, and access to the administrative user's email.

Affected products

• Bravis-Themes Bravis User: before 1.0.2 — fixed in 1.0.2

How to fix

Upgrade to a fixed version: Bravis-Themes Bravis User 1.0.2. Check the vendor advisory for mitigations.

References

• https://themeforest.net/item/graviton-construction-wordpress-theme/50429299
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c52f1a-2203-4abe-b777-064bd6fd1714?source=cve

Get alerted when CVE-2025-5060 or the next vulnerability affects your stack