{"id":"CVE-2025-7695","aliases":["EUVD-2025-22494","GHSA-pc8h-vv6v-5wqw"],"status":"published","title":"Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route","description":"The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0069,"percentile":0.53241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-07-24T09:22:21Z","modified":"2026-06-17T10:05:29Z","products":[{"vendor":"alexacrm","product":"dataverse integration"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd35a3c-7203-4832-8b0d-56f3e7983118?source=cve"},{"url":"https://wordpress.org/plugins/integration-cds/#developers"},{"url":"https://plugins.trac.wordpress.org/browser/integration-cds/trunk/src/API/AuthenticatedEndpoint.php"},{"url":"https://plugins.trac.wordpress.org/browser/integration-cds/trunk/src/API/Endpoints/GetResetUserPasswordLink.php"},{"url":"https://plugins.trac.wordpress.org/changeset?new=3329717%40integration-cds%2Ftrunk\u0026old=3323579%40integration-cds%2Ftrunk"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7695"},{"url":"https://github.com/advisories/GHSA-pc8h-vv6v-5wqw"}],"sources":{"cve":[{"id":"CVE-2025-7695","title":"Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route","description":"The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account.","status":"published","published":"2025-07-24T09:22:21.27Z","modified":"2025-07-24T13:13:39.837Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:51.544289Z"}],"euvd":[{"id":"EUVD-2025-22494","description":"The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account.","status":"published","published":"2025-07-24T09:22:21Z","modified":"2025-07-24T13:13:39Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:04.291169Z"}],"ghsa":[{"id":"GHSA-pc8h-vv6v-5wqw","title":"The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to...","description":"The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account.","status":"published","published":"2025-07-25T15:30:44Z","modified":"2025-07-25T15:30:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:03:06.773491Z"}],"nvd":[{"id":"CVE-2025-7695","description":"The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account.","status":"published","published":"2025-07-24T10:15:28.443Z","modified":"2026-06-17T10:05:29.01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:19.382856Z"}]}}