CVE-2025-10684 - Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation

CVE ID : CVE-2025-10684 Published : Dec. 12, 2025, 6:15 a.m. | 1 hour, 32 minutes ago Description : The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary . Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor