WPshop 2 – E-Commerce, CVE-2025-3853

CVE, Research URL: CVE-2025-3853
Home page URL: Security reports for WPshop 2 – E-Commerce
Application: WPshop 2 – E-Commerce
Published on: May 07, 2025
Research Description: The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.
Affected versions: Min 2.0.0, max 2.6.0.
Status: vulnerable

WPshop 2 &#8211; E-Commerce, CVE-2025-3853