What the vulnerability does
01Description
The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account.
Explanation of Vulnerability in Simple Terms
02Summary
Dataverse Integration versions 2.77 through 2.81 lack proper authorization checks, allowing authenticated users to read, modify, or delete data they should not have access to. An attacker with low-privilege credentials can escalate their access to sensitive information and make unauthorized changes. The vulnerability affects confidentiality, integrity, and availability of data stored in the integration.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data without proper authorization checks.
Potential impact on your site
04Site Impact
Unauthorized data access, modification, or deletion by authenticated users with limited permissions.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
July 24, 2025
CVE published
July 24, 2025
Record updated
