What is CVE-2025-4797?

CVE-2025-4797 is a critical-severity vulnerability in Uxper Golo - City Travel Guide Wordpress Theme, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 9.8/10. Published 2025-06-03.

How severe is CVE-2025-4797?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Uxper Golo - City Travel Guide Wordpress Theme

CVE-2025-4797

The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.7.0. This is due to the plugin not properly validating a user's identity prior to setting an authorization cookie. This makes it possible for unauthenticated attackers to log in as any user, including administrators, provided they know the user's email address. CVE-2025-54725 is likely a duplicate of this issue.

EPSS: 0.004 (35.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Uxper Golo - City Travel Guide Wordpress Theme — versions 0

Weakness classification (CWE)

CWE-288 — Authentication Bypass Using an Alternate Path or Channel

References

Frequently asked questions

What is CVE-2025-4797?: CVE-2025-4797 is a critical-severity vulnerability in Uxper Golo - City Travel Guide Wordpress Theme, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 9.8/10. Published 2025-06-03.
How severe is CVE-2025-4797?: Critical severity. CVSS v3 base score is 9.8 out of 10.