Privilege Escalation in Dataverse Integration Plugin for WordPress

CVE-2025-7695

What is CVE-2025-7695?

The Dataverse Integration plugin for WordPress contains a vulnerability that allows authenticated attackers to escalate their privileges. This issue arises from inadequate authorization checks within the reset_password_link REST endpoint. By supplying a user ID, email, or login, an attacker with Subscriber-level access or higher can exploit the endpoint to obtain a password reset link for any administrator account. This could lead to account hijacking, as the endpoint does not verify whether the user making the request has permissions to modify or access the target account's information.

References