Hybrid Composer Vulnerabilities

The Hybrid Composer plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.4.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.4.6

Fixed in:

1.4.7

Disclosed:

Jun 5, 2026

CVE-2019-25738 on NVD →

Unauthenticated Options Update vulnerability found by rootetsy in WordPress Hybrid Composer plugin (versions <= 1.4.6).

Affected:

up to 1.4.7

Fixed in:

1.4.7

Disclosed:

Jul 13, 2019

The Hybrid Composer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the hc_ajax_save_option function in versions up to, and including, 1.4.6. This makes it possible for unauthenticated attackers to fully access and modify administrative settings/actions.

CVSS:

6.5

Affected:

up to 1.4.6

Fixed in:

1.4.7

Disclosed:

Jul 10, 2019

The Hybrid Composer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the hc_ajax_save_option function in versions up to, and including, 1.4.6. This makes it possible for unauthenticated attackers to fully access and modify administrative settings/actions.

Affected:

up to 1.4.7

Fixed in:

1.4.7

Disclosed:

Jul 10, 2019

This plugin has a function to update Wordpress options via Ajax and it&#039;s set with the following: add_action(&#039;wp_ajax_nopriv_hc_ajax_save_option&#039;, &#039;hc_ajax_save_option&#039;); Which means it does not require authentication and is exploitable by anyone on the internet. I&#039;ve already spoken...

Affected:

up to 1.4.7

Fixed in:

1.4.7