CVE-2025-3063: Shopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
First published: Wed Apr 02 2025(Updated: )
The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_callback_update_sa_option() function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Shopper Approved Reviews | >=2.0<=2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3063?
The severity of CVE-2025-3063 is categorized as high due to the potential for privilege escalation and unauthorized data modification.
How do I fix CVE-2025-3063?
To fix CVE-2025-3063, update the Shopper Approved Reviews plugin to a version higher than 2.1 where the vulnerability has been addressed.
Who is affected by CVE-2025-3063?
CVE-2025-3063 affects users of the Shopper Approved Reviews plugin for WordPress versions 2.0 to 2.1.
What is the impact of exploiting CVE-2025-3063?
Exploiting CVE-2025-3063 could allow an authenticated attacker to modify data and escalate privileges within the WordPress site.
Is there a workaround for CVE-2025-3063?
A temporary workaround for CVE-2025-3063 is to disable the Shopper Approved Reviews plugin until it can be updated to a secure version.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/shopper approved
- canonical/shopper approved reviews