CVE-2025-3063 Overview
CVE-2025-3063 affects the Shopper Approved Reviews plugin for WordPress in versions 2.0 through 2.1. The plugin's ajax_callback_update_sa_option() function lacks a capability check, allowing authenticated users with Subscriber-level access to modify arbitrary WordPress options. Attackers can change the default registration role to administrator and enable open registration. This chain grants them administrator accounts on the target site. The vulnerability is classified under CWE-862: Missing Authorization.
Critical Impact
Authenticated Subscriber-level users can escalate to administrator by modifying WordPress site options through an unprotected AJAX endpoint.
Affected Products
- Shopper Approved Reviews plugin for WordPress version 2.0
- Shopper Approved Reviews plugin for WordPress version 2.1
- WordPress sites with the plugin active and open user registration or any authenticated low-privilege user
Discovery Timeline
- 2025-04-02 - CVE-2025-3063 published to the National Vulnerability Database (NVD)
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-3063
Vulnerability Analysis
The Shopper Approved Reviews plugin registers an AJAX action handled by ajax_callback_update_sa_option(). This callback writes values to WordPress options through update_option() but never verifies the calling user's capabilities. Any authenticated session, including a Subscriber account, can invoke the endpoint and overwrite arbitrary option names and values.
WordPress stores critical configuration in the options table, including default_role and users_can_register. An attacker sets default_role to administrator and toggles users_can_register to 1. The attacker then registers a new account through wp-login.php?action=register and receives administrator privileges on creation.
From that point, full site compromise follows. The attacker can install malicious plugins, upload PHP webshells, exfiltrate database contents, or pivot to the underlying host. The flaw is exploitable over the network with low privileges and no user interaction.
Root Cause
The root cause is a missing current_user_can() check and absent nonce validation inside ajax_callback_update_sa_option(). The handler is registered for both wp_ajax_ and effectively reachable by any logged-in user, violating WordPress capability conventions for privileged option writes. See the WordPress Plugin Code Review for the unprotected function.
Attack Vector
Exploitation requires a valid WordPress account at Subscriber level or higher. The attacker sends an authenticated POST request to /wp-admin/admin-ajax.php targeting the plugin's update action and supplies the option name and value to overwrite. No exploit code is needed beyond a standard HTTP client with a session cookie.
No verified proof-of-concept code is published. The Wordfence Vulnerability Report documents the technical details.
Detection Methods for CVE-2025-3063
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing the Shopper Approved Reviews update action from non-administrator sessions
- Unexpected changes to the default_role option, particularly values of administrator or editor
- The users_can_register option flipped from 0 to 1 without an administrator action
- New administrator accounts created shortly after Subscriber-level logins from the same IP
Detection Strategies
- Audit the wp_options table for recent modifications to default_role, users_can_register, and siteurl
- Review web server access logs for admin-ajax.php calls referencing the plugin's update_sa_option action paired with low-privilege session cookies
- Correlate new wp_users rows and wp_usermeta capability assignments against the timing of suspicious AJAX traffic
- Monitor WordPress security plugin logs for option-change events outside maintenance windows
Monitoring Recommendations
- Enable WordPress audit logging for option updates, user role changes, and new user registrations
- Forward web server and WordPress logs to a SIEM and alert on privilege role changes for newly registered accounts
- Track plugin inventory and flag any host running Shopper Approved Reviews 2.0 or 2.1
How to Mitigate CVE-2025-3063
Immediate Actions Required
- Deactivate and remove the Shopper Approved Reviews plugin until a patched version is installed
- Audit all WordPress accounts and remove any unrecognized administrators created since the plugin was active
- Reset credentials for all administrator accounts and rotate WordPress salts in wp-config.php
- Restore default_role to subscriber and set users_can_register to 0 unless open registration is required
Patch Information
No vendor-confirmed patched version is listed in the NVD record at the time of publication. Monitor the Wordfence Vulnerability Report and the WordPress plugin repository for an update beyond version 2.1. Apply the patched release immediately when published.
Workarounds
- Block POST requests to admin-ajax.php that reference the vulnerable plugin action at the web application firewall (WAF) layer
- Restrict user registration site-wide and require manual administrator approval for new accounts
- Limit access to /wp-admin/ and /wp-login.php by IP allowlist where operationally feasible
- Apply the principle of least privilege and audit any non-essential Subscriber, Contributor, or Author accounts
# Disable open registration and reset the default role via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
# Force deactivation of the vulnerable plugin
wp plugin deactivate shopperapproved-reviews
wp plugin delete shopperapproved-reviews
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
