Account Takeover Vulnerability in BuddyPress Force Password Change Plugin for WordPress

CVE-2025-3793

What is CVE-2025-3793?

The BuddyPress Force Password Change plugin for WordPress contains a significant flaw that allows authenticated users to take over other accounts. This vulnerability arises from inadequate validation of user identity when updating passwords via the 'bp_force_password_ajax' function. Authenticated attackers with subscriber-level access, given certain conditions, can exploit this weakness to reset passwords for other users, including those with administrator roles. As a result, potentially unprotected accounts may be compromised, leading to unauthorized access and control over sensitive information.

References