Insecure Direct Object Reference in WP SmartPay Plugin for WordPress
CVE-2025-3851
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 May 2025
What is CVE-2025-3851?
The WP SmartPay plugin for WordPress is susceptible to an Insecure Direct Object Reference, present in versions 1.1.0 to 2.7.13. This vulnerability arises from insufficient validation on a user-controlled key in the show() function, allowing authenticated attackers with Subscriber-level access or higher to access sensitive information belonging to other users, including email addresses, names, and notes. This issue poses significant risks to user privacy and data integrity.
Affected Version(s)
Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 <= 2.7.13