WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-3852
- 2026-10-03 Alias added: GHSA-v38f-7vmx-25h7
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/96b8186c-dfe9-4137-b28d-cc09a25aa9ac?source=cve
- https://plugins.trac.wordpress.org/browser/wpshop/tags/2.6.0//core/external/eo-framework/modules/wpeo-model/class/user.class.php#L132
- https://plugins.trac.wordpress.org/browser/wpshop/tags/2.6.0/core/external/eo-framework/modules/wpeo-model/class/rest.class.php#L41
- https://plugins.trac.wordpress.org/browser/wpshop/tags/2.6.0//modules/api/action/class-api-action.php#L32
More eoxia vulnerabilities
- TI-2015-08063 WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2026-03467 Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter CVSS 3.1MEDIUM 6.5
- TI-2025-03402 Authorization bypass in eoxia WPshop 2 – E-Commerce CVSS 3.1MEDIUM 6.5
- TI-2026-01988 Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Read CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-3852 · CVE Program
- CVE-2025-3852 · NVD
- FIRST EPSS
- GHSA-v38f-7vmx-25h7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences