Privilege Escalation in Dataverse Integration Plugin for WordPress

CVE-2025-7695

What is CVE-2025-7695?

The Dataverse Integration plugin for WordPress contains a vulnerability that allows authenticated attackers to escalate their privileges. This issue arises from inadequate authorization checks within the reset_password_link REST endpoint. By supplying a user ID, email, or login, an attacker with Subscriber-level access or higher can exploit the endpoint to obtain a password reset link for any administrator account. This could lead to account hijacking, as the endpoint does not verify whether the user making the request has permissions to modify or access the target account's information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References