Unauthorized Data Modification in SecuPress Free WordPress Security Plugin

CVE-2025-3452

What is CVE-2025-3452?

The SecuPress Free plugin for WordPress is susceptible to unauthorized data modification owing to a lack of capability checks in the 'secupress_reinstall_plugins_admin_ajax_cb' function. This vulnerability affects all versions up to 2.3.9 and permits authenticated attackers with Subscriber-level access and higher to install arbitrary plugins, posing serious risks to site security. Administrators should review their installations and apply necessary updates to mitigate potential exploits.

References