VulnSocial

CVE-2025-3603Disclosure(flynax / flynax_bridge)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

flynax CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-620

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • flynax_bridge

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
flynax
Products
flynax_bridge

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-08: 1Technical Details · 2026-04-08: 104-08
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2025-3603: Flynax Bridge <= 2.2.0 - Unauthen... No auth required to reset any WordPress admin password through Flynax Bridge's broken user validation - instant site tak... https://zerodaysignal.com/vulnerability/CVE-2025-3603 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The post announces a new authentication bypass flaw in Flynax Bridge (≤2.2.0) that allows unauthenticated password resets for WordPress admins, but no PoC or exploitation details are provided.

    00000305
    204 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appflynaxflynax_bridge-wordpress-

Explore more

Back to dashboardflynax CVEsflynax_bridge vulnerabilities