Privilege Escalation Vulnerability in WP SmartPay WordPress Plugin

CVE-2025-3848

What is CVE-2025-3848?

The WP SmartPay plugin for WordPress is susceptible to privilege escalation due to improper user identity validation when updating email addresses. This vulnerability allows authenticated attackers, with Subscriber-level access or higher, to alter the email addresses of arbitrary users, including administrators. By exploiting this flaw, attackers can reset user passwords and gain unauthorized access to accounts, significantly compromising site security. It is crucial for users of this plugin to update to the latest version to mitigate this risk.

References