CVE-2025-3851: WP SmartPay Information Disclosure Flaw

CVE-2025-3851 Overview

CVE-2025-3851 is an Insecure Direct Object Reference (IDOR) vulnerability in the Download Manager and Payment Form WordPress Plugin – WP SmartPay. The flaw affects plugin versions 1.1.0 through 2.7.13 and stems from missing validation on a user-controlled key inside the show() function of the customer REST controller. Authenticated attackers with Subscriber-level access or higher can enumerate other users' records and read sensitive data such as email addresses, names, and customer notes. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Any authenticated WordPress account, including low-privileged Subscribers, can retrieve personally identifiable information belonging to other SmartPay customers.

Affected Products

Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 through 2.7.13
WordPress sites using the SmartPay REST CustomerController
Deployments exposing SmartPay customer endpoints to authenticated users

Discovery Timeline

2025-05-07 - CVE-2025-3851 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3851

Vulnerability Analysis

The vulnerability resides in the show() method of the SmartPay CustomerController REST endpoint. The controller accepts a customer identifier from the request and returns the matching customer record without verifying that the requesting user owns that record or has an appropriate role. As a result, an authenticated attacker can substitute arbitrary identifiers and receive another user's stored data.

Exposed fields include the customer's email address, full name, and notes attached to the customer profile. Because the endpoint only requires an authenticated session, exploitation is possible from a default Subscriber account, which WordPress sites frequently allow via open registration. The vulnerability does not affect data integrity or availability, but it enables broad enumeration of customer records.

Root Cause

The root cause is a missing authorization check on a user-controlled object identifier, the classic pattern for Insecure Direct Object Reference vulnerabilities [CWE-200]. The show() handler trusts the identifier supplied in the request and performs the lookup without correlating it against the authenticated user's own customer record or capability set. See the WordPress SmartPay Controller Code for the affected function.

Attack Vector

The attacker registers or uses any existing account with Subscriber-level access or above. They then issue authenticated HTTP requests to the SmartPay customer REST route, iterating the customer identifier parameter to retrieve records that belong to other users. No user interaction is required from the victim. Additional context is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-3851

Indicators of Compromise

Authenticated requests to the SmartPay customer REST endpoint from Subscriber-level accounts that would not normally interact with customer data.
Sequential or high-volume requests iterating numeric customer identifiers against the CustomerControllershow() route.
Access log entries showing HTTP 200 responses for customer records that do not correspond to the authenticated user's own account.

Detection Strategies

Review WordPress and web server access logs for repeated calls to SmartPay customer REST paths originating from low-privileged sessions.
Correlate authentication events with REST API access patterns to identify Subscriber accounts querying customer objects.
Deploy WordPress security plugins or a web application firewall rule that flags enumeration patterns against SmartPay endpoints.

Monitoring Recommendations

Alert on new Subscriber account registrations followed shortly by REST API calls to plugin endpoints.
Track response size and record identifiers returned by the SmartPay customer endpoint to detect bulk data pulls.
Monitor for anomalous outbound traffic from web servers that could indicate exfiltration of harvested customer data.

How to Mitigate CVE-2025-3851

Immediate Actions Required

Update the WP SmartPay plugin to a version later than 2.7.13 as soon as a patched release is available.
Audit existing WordPress user accounts and remove unused or untrusted Subscriber accounts.
Disable open user registration on sites that do not require it, using the WordPress General Settings option.

Patch Information

The vulnerability is present in WP SmartPay versions 1.1.0 through 2.7.13. Administrators should apply the vendor's fixed release once published and confirm the deployed version in the WordPress plugins dashboard. Refer to the Wordfence Vulnerability Report for tracking of the fixed version.

Workarounds

Restrict access to SmartPay REST endpoints using a web application firewall rule that requires elevated capabilities.
Temporarily deactivate the WP SmartPay plugin on sites that cannot upgrade immediately and do not depend on it for active transactions.
Enforce strong role management so that only trusted staff hold roles above Subscriber, reducing the population of accounts able to exploit the endpoint.

bash

# Configuration example: disable open registration and verify plugin version via WP-CLI
wp option update users_can_register 0
wp plugin get smartpay --field=version
wp plugin deactivate smartpay # optional, if upgrade is not yet possible