CVE-2025-3452: SecuPress WordPress Security Auth Bypass

CVE-2025-3452 Overview

CVE-2025-3452 affects the SecuPress Free — WordPress Security plugin in all versions up to and including 2.3.9. The plugin fails to enforce a capability check on the secupress_reinstall_plugins_admin_ajax_cb AJAX handler. Authenticated users with Subscriber-level access or higher can invoke the handler and install arbitrary plugins on the WordPress site. The flaw is categorized as Missing Authorization [CWE-862].

Critical Impact
Any authenticated user with Subscriber role or above can install arbitrary WordPress plugins, expanding the site's attack surface and enabling follow-on compromise through vulnerable or attacker-supplied plugin code.

Affected Products

SecuPress Free — WordPress Security plugin, all versions through 2.3.9
WordPress installations exposing subscriber or higher user accounts
Sites permitting open registration with SecuPress Free installed

Discovery Timeline

2025-04-29 - CVE-2025-3452 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3452

Vulnerability Analysis

The vulnerability resides in the secupress_reinstall_plugins_admin_ajax_cb function within the SecuPress plugin's plugin management module. The handler is registered against the wp_ajax_ action hook, which authenticates any logged-in WordPress user but does not, by itself, enforce role restrictions. The function processes reinstall requests without invoking a current_user_can() capability check such as install_plugins or manage_options.

The missing authorization allows a low-privileged authenticated user to trigger plugin installation flows normally reserved for administrators. An attacker who registers as a Subscriber can call the AJAX endpoint and cause WordPress to download and install plugin packages. Installed plugins expand the site's code footprint and can introduce additional vulnerabilities that enable privilege escalation or remote code execution paths.

Root Cause

The root cause is a Missing Authorization defect [CWE-862] in the AJAX callback. WordPress plugin developers must gate privileged actions with both a nonce check and an explicit capability check. In SecuPress Free through 2.3.9, the reinstall handler omits the capability gate, so authentication alone is treated as authorization.

Attack Vector

Exploitation requires network access to the WordPress admin AJAX endpoint and valid Subscriber-level credentials. The attacker sends a crafted POST request to /wp-admin/admin-ajax.php with the SecuPress reinstall action parameter. The server executes the plugin installation on behalf of the low-privileged user. No user interaction is required beyond the initial authentication.

The vulnerability is described in prose only. See the WordPress Plugin Code Review and Wordfence Vulnerability Analysis for technical details.

Detection Methods for CVE-2025-3452

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php referencing the secupress_reinstall_plugins action from non-administrator sessions
Unexpected entries in the wp_options table under active_plugins or new directories under wp-content/plugins/
WordPress debug or access logs showing plugin installation events initiated by Subscriber, Contributor, or Author accounts
New user registrations followed shortly by AJAX activity targeting SecuPress endpoints

Detection Strategies

Correlate WordPress user role telemetry with plugin installation events to flag installs initiated by non-administrators
Monitor filesystem changes in wp-content/plugins/ and alert on plugin directory creation outside of scheduled maintenance windows
Inspect web server access logs for repeated calls to admin-ajax.php with SecuPress action parameters originating from a single low-privilege session

Monitoring Recommendations

Ingest WordPress audit logs into a centralized SIEM and alert on plugin install and activate events
Track SecuPress plugin version across managed WordPress instances and flag hosts still running 2.3.9 or earlier
Baseline the set of installed plugins per site and alert on additions not tied to an approved change ticket

How to Mitigate CVE-2025-3452

Immediate Actions Required

Update SecuPress Free to a version later than 2.3.9 that includes the capability check fix referenced in WordPress Changeset #3283453
Audit installed plugins on every SecuPress-protected site and remove any unrecognized additions
Review WordPress user accounts and disable open registration if it is not required for site functionality

Patch Information

The SecuPress maintainers addressed the missing authorization defect in the WordPress plugin repository under changeset 3283453. The patch adds a capability check to the secupress_reinstall_plugins_admin_ajax_cb handler so that only users with plugin installation privileges can invoke the reinstall flow. Site operators should upgrade to the latest SecuPress Free release published after this changeset.

Workarounds

Deactivate and remove the SecuPress Free plugin until a patched version can be installed
Restrict access to /wp-admin/admin-ajax.php at the web application firewall by blocking requests carrying the vulnerable action parameter from non-administrator sessions
Set disable_wp_cron and file-permission constants such as DISALLOW_FILE_MODS in wp-config.php to block plugin installation site-wide until remediation is complete

bash

# wp-config.php hardening to block plugin and theme installation
define( 'DISALLOW_FILE_MODS', true );