CVE Alert: CVE-2025-10293 – nexist – Keyy Two Factor Authentication (like Clef)

Risk verdict

High risk: privileged escalation via account takeover is possible for authenticated subscribers, so urgent patching is advised even though active exploitation isn’t confirmed.

Why this matters

If an attacker with subscriber-level access can hijack tokens to log in as administrators, they can read, modify or delete data, tamper with configurations, or move laterally across sites hosted on the same WordPress instance. The impact scales with the number of admin accounts and the value of data managed by the site.

Most likely attack path

An attacker already holding a subscriber+ account abuses token-generation flow due to improper authentication, enabling auto-login as other users (including admins) as long as admin 2FA is configured. No user interface prompt is required for the escalation, and the attack relies on existing credentials rather than external access vectors. Pre-conditions are modest (subscriber+ access; admin 2FA enabled); preconditions for broader exploitation are feasible in typical WP deployments.

Who is most exposed

WordPress sites with the Keyy plugin installed, especially those using shared hosting or public-facing admin portals with multiple user roles, are at greatest risk. Organisations relying on 2FA-enabled admin accounts without tight monitoring are particularly vulnerable.

Detection ideas

• Unusual admin logins from subscriber accounts or from new/IP changes.
• Token-generation requests or session creations that occur without password prompts.
• Multiple administrators logged in from the same subscriber session or rapid succession logins.
• Anomalous admin activity immediately following a subscriber login.

Mitigation and prioritisation

• Patch to a version beyond 1.2.3 or remove/disable the vulnerable Keyy plugin.
• In the interim: restrict subscriber capabilities, rotate admin tokens, and enforce stricter 2FA enforcement and session invalidation after token-related events.
• Disable or review token-generation endpoints; implement application-layer controls to limit token issuance.
• Change-management: test patch in a staging environment, then deploy organisation-wide with rollback plans.
• If KEV or EPSS signals become positive, treat as priority 1. Currently, escalate patching due to high CVSS impact and weak authentication.