Goodlayers Core < 2.1.7 - Authenticated (Contributor+) Privilege Escalation
2025-09-23 00:00
BondsStrategic Overview
StatusPatched in 2.1.7
Affected PluginGoodlayers Core
Affected Version
< 2.1.7CVSS4.3Medium
CVE
CVE-2025-59580Vulnerability Overview
The Goodlayers Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to 2.1.7 (exclusive). This is due to the plugin not properly restricting what roles a user can register with. This makes it possible for authenticated attackers, with Contributor-level access and above, to gain administrative access to the site.
Technical Analysis
REMEDIATION: Update to version 2.1.7, or a newer patched version --- IDENTIFIER: CWE-269 (Improper Privilege Management) The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C