EnvatoMarket

Hackers have exploited a critical vulnerability in the WordPress theme 'Motors', allowing them to hijack administrator accounts and gain full control of targeted sites. The flaw, tracked as CVE-2025-4322, was discovered in May 2025 and affects versions before and including 5.6.67. Despite a patch being released, many users failed to update, leading to widespread exploitation. Wordfence reported blocking 23,100 attempts against its customers by June 2025. The attackers reset administrator passwords and created new admin accounts for persistence, locking out existing administrators and compromising site security.

Source: https://www.bleepingcomputer.com/news/security/wordpress-motors-theme-flaw-mass-exploited-to-hijack-admin-accounts/

TPRM report: https://scoringcyber.rankiteo.com/company/envato-author-community

"id": "env003062325",
"linkid": "envato-author-community",
"type": "Vulnerability",
"date": "6/2025",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'E-commerce',
                        'name': 'EnvatoMarket',
                        'type': 'Marketplace'}],
 'attack_vector': 'Improper user identity validation during password updating',
 'date_detected': '2025-05-02',
 'date_publicly_disclosed': '2025-05-19',
 'description': 'Hackers are exploiting a critical privilege escalation '
                "vulnerability in the WordPress theme 'Motors' to hijack "
                'administrator accounts and gain complete control of a '
                'targeted site.',
 'impact': {'systems_affected': "WordPress sites using the 'Motors' theme"},
 'initial_access_broker': {'entry_point': 'Login Register widget'},
 'lessons_learned': 'Immediate updates are crucial when vulnerabilities are '
                    'disclosed to prevent exploitation.',
 'motivation': 'Gain complete control of a targeted site',
 'post_incident_analysis': {'corrective_actions': 'Update to the latest '
                                                  "version of the 'Motors' "
                                                  'theme',
                            'root_causes': 'Improper user identity validation '
                                           'during password updating'},
 'recommendations': "Update to the latest version of the 'Motors' theme and "
                    'block the IP addresses listed in the Wordfence report.',
 'references': [{'source': 'Wordfence'}],
 'response': {'remediation_measures': ['Update to Motors version 5.6.68']},
 'title': "Privilege Escalation Vulnerability in WordPress Theme 'Motors'",
 'type': 'Privilege Escalation',
 'vulnerability_exploited': 'CVE-2025-4322'}