Platform
wordpress
Component
wpshop
Fixed in
2.6.1
CVE-2025-3852 is a privilege escalation vulnerability discovered in the WPshop 2 – E-Commerce plugin for WordPress. This flaw allows authenticated attackers with subscriber-level access or higher to escalate their privileges and take over administrator accounts. The vulnerability affects versions 2.0.0 through 2.6.0 of the plugin. A fix is available in a subsequent release.
The impact of CVE-2025-3852 is significant due to its potential for complete account takeover. An attacker exploiting this vulnerability can modify the email address and password of any user, including the site administrator. This grants them full control over the WordPress site, enabling them to modify content, install malicious plugins, steal sensitive data, or even deface the website. The ease of exploitation, requiring only subscriber-level access, broadens the attack surface considerably. This vulnerability shares similarities with other WordPress plugin privilege escalation flaws where insufficient input validation leads to unauthorized account modifications.
CVE-2025-3852 was publicly disclosed on 2025-05-07. There is currently no indication of active exploitation campaigns targeting this vulnerability. The EPSS score is pending evaluation. Public proof-of-concept code is not yet available, but the vulnerability's nature suggests it is relatively straightforward to exploit.
Exploit Status
EPSS
0.33% (56% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-3852 is to upgrade the WPshop 2 – E-Commerce plugin to a version that includes the fix. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider restricting access to the plugin's update functionality to trusted administrators only. Implement stricter user role permissions to limit the capabilities of subscriber-level users. Regularly audit user accounts and permissions for any unauthorized changes. Monitor WordPress logs for suspicious activity related to user account modifications.
Actualice el plugin WPshop 2 – E-Commerce a la última versión disponible. La vulnerabilidad permite a usuarios autenticados con roles de suscriptor o superior tomar el control de cuentas de otros usuarios, incluyendo administradores, cambiando sus contraseñas.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-3852 is a vulnerability in WPshop 2 – E-Commerce versions 2.0.0–2.6.0 that allows attackers to escalate privileges and take over administrator accounts by modifying user details.
If you are using WPshop 2 – E-Commerce version 2.0.0 through 2.6.0, you are potentially affected by this vulnerability.
Upgrade the WPshop 2 – E-Commerce plugin to a version that includes the fix. If immediate upgrading is not possible, restrict access to the plugin's update functionality.
There is currently no indication of active exploitation campaigns targeting this vulnerability, but it is recommended to apply the fix as soon as possible.
Refer to the WPshop 2 – E-Commerce plugin's official website or WordPress plugin repository for the latest advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.