CVE-2025-13851 is a critical security vulnerability classified under CWE-269 (Improper Privilege Management) found in the Buyent Classified plugin for WordPress, which is bundled with the Buyent theme. The vulnerability exists in all versions up to and including 1.0.7. The root cause is the plugin's failure to validate or restrict the user role parameter during the registration process via the REST API endpoint. Specifically, attackers can manipulate the _buyent_classified_user_type parameter to assign themselves arbitrary roles, including administrator privileges, without any authentication or user interaction. This results in a privilege escalation attack vector that allows complete takeover of the WordPress site. The vulnerability is remotely exploitable over the network with low attack complexity and no privileges required, as reflected in the CVSS 3.1 score of 9.8 (critical). The impact includes full compromise of site confidentiality, integrity, and availability, enabling attackers to modify content, install malicious code, steal sensitive data, or disrupt services. No patches or official fixes are currently linked, and no known exploits have been observed in the wild, but the vulnerability's nature makes it a high-risk target for attackers. The vulnerability was reserved in December 2025 and published in February 2026 by Wordfence, a reputable security source.

For European organizations, this vulnerability poses a significant threat, especially those relying on WordPress sites with the Buyent theme and Classified plugin. Successful exploitation can lead to complete site takeover, allowing attackers to deface websites, steal or manipulate sensitive data, deploy malware, or use the compromised site as a launchpad for further attacks within the organization's network. This can result in reputational damage, regulatory non-compliance (e.g., GDPR violations due to data breaches), financial losses, and operational disruptions. Public-facing websites of businesses, government agencies, and e-commerce platforms are particularly vulnerable. The ease of exploitation and lack of authentication requirements increase the likelihood of automated attacks targeting vulnerable installations. Given WordPress's widespread use in Europe, the potential impact is broad, affecting small to large enterprises and critical infrastructure reliant on web presence.

Immediate mitigation steps include disabling user registration on affected WordPress sites if not required. If registration is necessary, implement custom validation to restrict user roles during registration, ensuring only default or safe roles are assigned. Monitor and restrict access to the REST API endpoints related to user registration, possibly via web application firewalls (WAFs) or security plugins that can filter malicious requests. Regularly audit user accounts for unauthorized administrator roles and remove suspicious accounts promptly. Since no official patch is currently available, organizations should consider applying custom code fixes to validate the _buyent_classified_user_type parameter or temporarily switch to alternative themes/plugins until a vendor patch is released. Additionally, maintain up-to-date backups and monitor logs for unusual registration activity. Engage with the plugin vendor or community for updates and patches. Employ network-level protections such as IP reputation filtering and rate limiting to reduce attack surface.