PT-2025-27585 · WordPress · Wp Smartpay

Kenneth Dunn

·

Published

2025-07-02

·

Updated

2025-07-07

·

CVE-2025-3848

Report an issue
CVSS v3.1
8.8
VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

WP SmartPay plugin for WordPress versions 1.1.0 through 2.7.13

Description:

The issue is related to privilege escalation via account takeover. This occurs because the plugin does not properly validate a user's identity before updating their email through the `update()` function. As a result, authenticated attackers with Subscriber-level access or higher can change arbitrary users' email addresses, including those of administrators, and then reset the user's password to gain access to their account.

Recommendations:

For WP SmartPay plugin for WordPress versions 1.1.0 through 2.7.13, consider disabling the `update()` function until a patch is available to prevent attackers from changing user email addresses and gaining unauthorized access. Restrict access to the plugin's functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-3848

Affected Products

Wp Smartpay