Introduction
Attackers can take over any AdForest-powered WordPress site running version 6.0.9 or earlier, with no password and no user interaction. The flaw gives remote, unauthenticated attackers access to administrator accounts, which puts all site data and configuration at risk.
AdForest is a commercial WordPress theme developed by Scriptsbundle and sold through ThemeForest. It is widely used for classified ad and directory sites and has more than 8,700 sales. Because the theme is popular and built for a specialized use, a flaw in its authentication is especially serious for organizations that run business-critical operations on it.
Technical Information
CVE-2025-8359 is an authentication bypass in all versions of the AdForest WordPress theme up to and including 6.0.9. The root cause is improper verification of user identity during authentication. The theme does not confirm that a user is who they claim to be before granting access, so an attacker can log in as any user, including an administrator, without a password.
The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), which means an attacker can gain access through an alternative or insufficiently protected authentication flow. Two earlier AdForest vulnerabilities, CVE-2024-12857 and CVE-2024-11349, were found in custom OTP login logic and in the sb_login_user_with_otp_fun function, where the theme did not properly validate user identity before granting authentication. The exact code path for CVE-2025-8359 has not been publicly disclosed, but the pattern indicates a recurring failure to enforce strong identity checks across the theme's custom authentication mechanisms.
Technical characteristics:
- Affects all AdForest theme versions up to and including 6.0.9
- Allows remote, unauthenticated attackers to log in as any user
- No password or user interaction required
- Exploitable via network requests
- Low attack complexity
As of this writing, no public code snippets or proof of concept have been released.
Patch Information
Google Chrome on Android had a domain spoofing vulnerability, CVE-2023-1234, which the development team fixed in version 111.0.5563.64. The update corrected an inappropriate implementation in the Intents system that let remote attackers spoof domains through crafted HTML pages. Users are strongly advised to update Chrome to version 111.0.5563.64 or later. (nvd.nist.gov)
Affected Systems and Versions
- AdForest WordPress theme, all versions up to and including 6.0.9
- Any WordPress installation using these versions of the theme is vulnerable
- Applies regardless of configuration or plugin state
Vendor Security History
Scriptsbundle, the developer of AdForest, has a documented history of authentication vulnerabilities in this theme:
- CVE-2024-12857 (up to 5.1.8): Authentication bypass via OTP login, fixed in 5.1.9
- CVE-2024-11349 (up to 5.1.6): Authentication bypass in
sb_login_user_with_otp_fun, fixed in 5.1.7 - CVE-2025-8359 (up to 6.0.9): Current vulnerability
The vendor has released patches for each issue, but the recurrence of similar flaws suggests that earlier fixes did not fully address underlying architectural weaknesses in the authentication logic. Organizations evaluating the security of an AdForest deployment should take this pattern into account.
