PT-2025-17720 · WordPress · Buddypress Force Password Change

Kenneth Dunn · Published 2025-04-24 · Updated 2025-04-24 · CVE-2025-3793

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Buddypress Force Password Change plugin for WordPress versions up to, and including, 0.1

Description The issue allows for authenticated account takeover due to improper validation of a user's identity prior to updating their password through the bp force password ajax function. This enables authenticated attackers with subscriber-level access and above, under certain prerequisites, to change arbitrary users' passwords, including administrators, and gain access to their accounts.

Recommendations For versions up to, and including, 0.1, as a temporary workaround, consider disabling the bp force password ajax function until a patch is available. Restrict access to password update functionality to minimize the risk of exploitation. Avoid using the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2025-3793

Affected Products

Buddypress Force Password Change

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-3793 · Security Note
• https://t.me/cvetracker/22279 · Telegram Post
• https://plugins.trac.wordpress.org/browser/buddy-press-force-password-change/trunk/bp-force-password-change.php#L93 · Note
• https://twitter.com/CVEnew/status/1915329386871496906 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e3048c4c-77b1-4778-a5d0-b532df777d06?source=cve · Note
• https://t.me/cvedetector/23655 · Telegram Post