CVE-2025-3604

Summary

CVE-2025-3604 is a privilege escalation vulnerability affecting the Flynax Bridge plugin for WordPress. The issue stems from the plugin's failure to validate user identities before updating email addresses. This weakness allows unauthenticated attackers to manipulate email addresses, including those of administrators, and subsequently reset passwords, resulting in account takeover. This vulnerability poses a significant risk, as it enables attackers to gain administrative access to WordPress sites using the Flynax Bridge plugin in versions up to and including 2.2.0.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.