WordPress - Hybrid Composer - CRITICAL - CVE-2019-25738. WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover. BADGES: 👾 EXPLOITED | 🟡 PoC | SecurityVulnerability.io