Insecure Direct Object Reference Vulnerability in WPshop E-Commerce Plugin for WordPress

CVE-2025-3853

What is CVE-2025-3853?

The WPshop 2 – E-Commerce plugin for WordPress contains a vulnerability that allows authenticated attackers to exploit the callback_generate_api_key() functionality. This issue arises from inadequate validation of a user-controlled key, enabling attackers with Subscriber-level access or higher to generate valid API keys for other users. Such exploitation can compromise user accounts and potentially lead to unauthorized access to sensitive data.

References