PT-2026-7512 · WordPress · Videospirecore Theme Plugin

Published 2026-02-11 · Updated 2026-02-16 · CVE-2025-15096

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Videospirecore Theme Plugin versions prior to 1.0.7

Description The 'Videospirecore Theme Plugin' for WordPress is susceptible to privilege escalation, potentially leading to account takeover. The issue arises from insufficient validation of a user’s identity before allowing updates to user details, such as email addresses. Authenticated attackers with Subscriber-level access or higher can modify the email addresses of any user, including administrators, and subsequently reset passwords to gain unauthorized access to accounts.

Recommendations Update the Videospirecore Theme Plugin to version 1.0.7 or later.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-15096

Affected Products

Videospirecore Theme Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-15096 · Security Note
• https://twitter.com/CVEnew/status/2021554584137711995 · Twitter Post
• https://t.me/CVEtracker/44404 · Telegram Post
• https://themeforest.net/item/videospire-video-streaming-ott-platform-wordpress-theme/39243225?s_rank=1 · Note
• https://twitter.com/CveFindCom/status/2021769095889269027 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/bf152269-73e1-473f-8d97-ce94e9b885d0?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2021616160588910998 · Twitter Post
• https://twitter.com/TheHackerWire/status/2021528825142894739 · Twitter Post
• https://t.me/cveNotify/151676 · Telegram Post
• https://twitter.com/cracbot/status/2023351723176464719 · Twitter Post