CVE-2025-3610: Privilege escalation vulnerability in the Reales WP STPT WordPress Plugin

Overview

CVE-2025-3610 is a critical vulnerability found in the widely used Reales WP STPT plugin for WordPress, a prevalent content management system. This vulnerability allows an attacker with subscriber-level access to perform a privilege escalation attack via account takeover. This flaw is critical due to the popularity of WordPress and the vast number of websites that could potentially be impacted. Given the severity of this vulnerability, understanding its mechanics and ways to mitigate its impact is crucial for all WordPress administrators.

Vulnerability Summary

CVE ID: CVE-2025-3610
Severity: High (CVSS: 8.8)
Attack Vector: Network
Privileges Required: Low (Subscriber Access Level)
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Reales WP STPT Plugin for WordPress | All versions up to and including 2.1.2

How the Exploit Works

The vulnerability exists because the Reales WP STPT plugin does not adequately verify a user’s identity before updating their account details. An attacker with subscriber-level access can exploit this flaw to change the passwords and email addresses of arbitrary users, including administrators. Once the attacker has control over an administrator account, they can take over the entire WordPress site. This vulnerability can also be combined with CVE-2025-3609 to execute code remotely, even if the attacker was initially an unauthenticated user without an account.

Conceptual Example Code

Below is a conceptual example of how this vulnerability might be exploited using a HTTP POST request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
action=wpstpt_update_user&user_id=1&user_pass=new_admin_password&user_email=attacker@example.com

In this example, the attacker is sending a POST request to the `admin-ajax.php` endpoint, which the Reales WP STPT plugin uses. The `wpstpt_update_user` action is called, which updates the user’s details. The `user_id` parameter is set to `1` (usually the admin user in WordPress) and the `user_pass` and `user_email` parameters are set to the attacker’s desired values.

Mitigation Guidance

WordPress administrators using the Reales WP STPT plugin are advised to apply the latest patches provided by the vendor. If a patch is not immediately available or cannot be applied in a timely manner, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) could provide temporary mitigation against this vulnerability. Administrators should also consider limiting the privileges of all users and constantly monitoring the account activities to detect any unusual changes.