CVE-2025-11522 CRITICAL

CVE-2025-11522: Search & Go - Directory WordPress Theme <= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover

Vendor Elated-Themes
Product Search & Go - Directory WordPress Theme
Weakness CWE-288
Published October 9, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user() function This makes it possible for unauthenticated attackers to gain access to other user's accounts, including administrators, when Facebook login is enabled. CVE-2025-62064 is likely a duplicate of this CVE.

Explanation of Vulnerability in Simple Terms

02Summary

The Search & Go directory theme for WordPress contains an authentication bypass vulnerability affecting versions 2.7 and earlier. An attacker can read, modify, or delete site data without logging in. The vulnerability stems from improper authentication checks in core functionality. All users should update immediately to a patched version.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete any site data without authentication.

Potential impact on your site

04Site Impact

Attackers can compromise your entire site, steal user data, modify content, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

October 9, 2025 CVE published
April 8, 2026 Record updated