平台
wordpress
组件
wpshop
修复版本
2.6.1
CVE-2025-3852 is a privilege escalation vulnerability discovered in the WPshop 2 – E-Commerce plugin for WordPress. This flaw allows authenticated attackers with subscriber-level access or higher to escalate their privileges and take over administrator accounts. The vulnerability affects versions 2.0.0 through 2.6.0 of the plugin. A fix is available in a subsequent release.
The impact of CVE-2025-3852 is significant due to its potential for complete account takeover. An attacker exploiting this vulnerability can modify the email address and password of any user, including the site administrator. This grants them full control over the WordPress site, enabling them to modify content, install malicious plugins, steal sensitive data, or even deface the website. The ease of exploitation, requiring only subscriber-level access, broadens the attack surface considerably. This vulnerability shares similarities with other WordPress plugin privilege escalation flaws where insufficient input validation leads to unauthorized account modifications.
CVE-2025-3852 was publicly disclosed on 2025-05-07. There is currently no indication of active exploitation campaigns targeting this vulnerability. The EPSS score is pending evaluation. Public proof-of-concept code is not yet available, but the vulnerability's nature suggests it is relatively straightforward to exploit.
Websites using the WPshop 2 – E-Commerce plugin, particularly those with subscriber-level users who have access to modify user details, are at risk. Shared hosting environments where multiple WordPress sites share the same server resources are also at increased risk, as a compromise on one site could potentially lead to attacks on others.
• wordpress / composer / npm:
grep -r 'update\(\$wpdb->prepare' /var/www/wordpress/wp-content/plugins/wpshop2-e-commerce/• wordpress / composer / npm:
wp plugin list --status=all | grep wpshop2-e-commerce• wordpress / composer / npm:
wp plugin update wpshop2-e-commerce --alldisclosure
漏洞利用状态
EPSS
0.33% (56% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2025-3852 is to upgrade the WPshop 2 – E-Commerce plugin to a version that includes the fix. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider restricting access to the plugin's update functionality to trusted administrators only. Implement stricter user role permissions to limit the capabilities of subscriber-level users. Regularly audit user accounts and permissions for any unauthorized changes. Monitor WordPress logs for suspicious activity related to user account modifications.
Actualice el plugin WPshop 2 – E-Commerce a la última versión disponible. La vulnerabilidad permite a usuarios autenticados con roles de suscriptor o superior tomar el control de cuentas de otros usuarios, incluyendo administradores, cambiando sus contraseñas.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-3852 is a vulnerability in WPshop 2 – E-Commerce versions 2.0.0–2.6.0 that allows attackers to escalate privileges and take over administrator accounts by modifying user details.
If you are using WPshop 2 – E-Commerce version 2.0.0 through 2.6.0, you are potentially affected by this vulnerability.
Upgrade the WPshop 2 – E-Commerce plugin to a version that includes the fix. If immediate upgrading is not possible, restrict access to the plugin's update functionality.
There is currently no indication of active exploitation campaigns targeting this vulnerability, but it is recommended to apply the fix as soon as possible.
Refer to the WPshop 2 – E-Commerce plugin's official website or WordPress plugin repository for the latest advisory and update information.
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。