CVE-2025-0177 is a critical (CVSS 9.8) privilege escalation in the Javo Core plugin for WordPress, in all versions up to and including 3.0.0.080. The registration form lets new users choose their own role, so an unauthenticated visitor can create an administrator account. Update to a release after 3.0.0.080 and audit your admin accounts.
What's affected
The record covers the Javo Core plugin by Javothemes, which ships with the Javo Directory WordPress theme, in all versions up to and including 3.0.0.080. The description says the plugin allows users who are registering new accounts to set their own role, so an unauthenticated attacker can create an account with the administrator role.
The references are the theme's item page, which carries an update history, and a Wordfence vulnerability entry. We could not read either automatically, so we cannot name the first fixed version here. Look in the update history of the Javo Directory theme for the release that follows 3.0.0.080.
The plugin is bundled with a commercial theme, so updates may come through the theme package and your marketplace download rather than from the WordPress plugin directory.
How to check if you're exposed
Check whether the plugin is present and which version.
wp plugin list
Look for Javo Core and read its version. You can also open Plugins in the WordPress admin.
Because the outcome is a new administrator account, check for signs of abuse.
- Open Users and filter by the Administrator role. Remove any account that you do not recognize.
- Sort by registration date and look for accounts created without your knowledge.
- Review recent changes to plugins, themes and posts, and check the uploads folder for files that do not belong.
- Review web logs for registration requests with an unusual role parameter.
What to do now
- Find sites that run the Javo Directory theme or the Javo Core plugin.
- Update to a release after 3.0.0.080, using the theme update history to find it.
- Audit administrator accounts and remove unknown ones.
- Reset passwords for all remaining administrators and rotate site secrets if you find a rogue admin.
- Review installed plugins and themes and the uploads folder for anything unexpected.
- Turn off open user registration if your site does not need it.
Why it matters
This bug is a trust mistake in a form. The registration handler accepted a role value from the browser instead of deciding the role on the server. Anything the browser sends can be changed by the person using it, so a role must never come from the request.
The class is improper privilege management. The fix is to ignore any role in the registration request and assign the default role on the server. Because the result is a full administrator, the impact on a WordPress site is complete: an administrator can install plugins, which means running code on the server.
The weakness class is CWE-269: Improper Privilege Management. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account first?
No. The record says unauthenticated attackers can create an administrator account through registration.
What should I check after updating?
Review the administrator list and recent changes for anything you did not make.
Sources
- Javo Directory theme page with update history
- Wordfence vulnerability entry listed in the CVE record
Last reviewed: 19 October 2026.
