CVE-2025-3793: Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update
The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bpforcepasswordajax' function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with subscriber-level access and above and under certain prerequisites, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3793?
CVE-2025-3793 is considered a high severity vulnerability due to the potential for authenticated account takeover.
How do I fix CVE-2025-3793?
To fix CVE-2025-3793, update the Buddypress Force Password Change plugin to a patched version that properly validates user identity before allowing password updates.
Who is affected by CVE-2025-3793?
All users of the Buddypress Force Password Change plugin versions up to and including 0.1 are affected by CVE-2025-3793.
What type of attack does CVE-2025-3793 allow?
CVE-2025-3793 allows an authenticated user to take over another user's account by changing their password without proper validation.
Is there any workaround for CVE-2025-3793?
Disabling the Buddypress Force Password Change plugin until it is updated is a viable workaround for CVE-2025-3793.