CVE-2025-10299 is a privilege escalation vulnerability in the WPBifröst – Instant Passwordless Temporary Login Links WordPress plugin caused by a missing capability check on the ctl_create_link AJAX action. This allows authenticated users with minimal privileges (Subscriber-level and above) to create new administrative user accounts without proper authorization. The vulnerability affects all plugin versions up to 1.0.7. Exploitation leads to full administrative access to the WordPress site. The vulnerability has a CVSS 3.1 score of 8.8, indicating a high-severity issue. No patch or official fix has been published as of the data provided.

Successful exploitation allows an authenticated low-privilege user to escalate their privileges to administrator by creating new admin accounts. This compromises the confidentiality, integrity, and availability of the WordPress site, enabling full site takeover. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only or consider disabling the plugin to prevent exploitation. Monitor for updates from the vendor regarding patches or temporary mitigations.