CVE-2025-4179 Flynax Bridge <= 2.2.0 - Unauthenticated Limited Privilege Escalation
Unauthenticated attackers can register as authors due to missing capability checks in the Flynax Bridge WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4179?
CVE-2025-4179 is a high-severity vulnerability in v1rustyle Flynax Bridge, published on 2 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to register new user accounts as authors.
Weakness: CWE-862
Which versions are affected by CVE-2025-4179?
It affects 1 product.
Products include Flynax Flynax Bridge.
How do I fix CVE-2025-4179?
No fix has been published for CVE-2025-4179 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-4179 being exploited?
There is no known exploitation of CVE-2025-4179 in the wild and no public exploit code.
Other vulnerabilities in v1rustyle Flynax Bridge
Sources
Also known as GHSA-7cm5-6vm2-x739.