CVE-2025-3853 MEDIUM

CVE-2025-3853: WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation

Vendor Eoxia
Product WPshop 2 – E-Commerce
Weakness CWE-639 · IDOR
Published May 7, 2025
Last update May 7, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.

Explanation of Vulnerability in Simple Terms

02Summary

WPshop 2 versions 2.0.0 through 2.6.0 contain a vulnerability that allows an attacker to read sensitive data and modify site content without authentication. The vulnerability requires only network access and can be exploited immediately without user interaction. Site administrators should update to a version newer than 2.6.0 as soon as possible.

What an attacker can do

03Attacker Capabilities

Read sensitive data and modify site content without logging in.

Potential impact on your site

04Site Impact

Attackers can view and alter store data and content without any credentials.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

May 7, 2025 CVE published
May 7, 2025 Record updated