CVE-2025-10656 is a WordPress plugin vulnerability with a CVSS 9.8 rating, and the score is warranted—but not for the reasons the severity implies. This is not a nuanced privilege escalation or a chaining requirement. This is unauthenticated administrative user creation: any visitor to the site can fabricate a new admin-level account with no credential, phishing, or prior access required. That puts this ahead of many actual RCE vulnerabilities in practical impact, because a new admin account provides persistent dashboard access, plugin installation, theme editing, and a quiet foothold that survives trivial server-side remediation.
The low EPSS score (0.00492) warrants skepticism, not relief. WordPress plugin CVEs live in a fragmented ecosystem where automated exploitation tooling targets specific plugins inconsistently—low EPSS here likely reflects scanner coverage gaps rather than exploitation difficulty. Assume the vulnerability will be weaponized when this CVE propagates into standard WordPress attack frameworks; the half-life of the exploitation knowledge is months, not weeks.
The more important question is what the patch actually hardened. If version 2.4.38 added only a current_user_can() check without nonce validation or input sanitization hardening, treat adjacent functions in the same codebase as suspect—the same developer logic that exposed user_filter likely left similar patterns nearby. The dangerous code likely persists in the patched version (the fix typically gates rather than removes), meaning anyone who doesn't patch remains trivially exploitable.
Prioritize this patch. The attack requires no authentication, the payload is admin account creation, and the exploitation chain is well-understood in the WordPress vulnerability ecosystem. Treat any delay as active exposure.