CVE-2025-3853 Overview
CVE-2025-3853 affects the WPshop 2 – E-Commerce plugin for WordPress in versions 2.0.0 through 2.6.0. The vulnerability is an Insecure Direct Object Reference [CWE-639] in the callback_generate_api_key() function. The function fails to validate a user-controlled key parameter before generating API keys. Authenticated attackers with Subscriber-level access or higher can create valid API keys on behalf of other users. This allows account takeover of higher-privileged accounts through the plugin's REST API. The vulnerability was published on May 7, 2025, and impacts any WordPress site running the affected plugin versions.
Critical Impact
Authenticated attackers with minimal privileges can generate API keys for arbitrary users, enabling horizontal and vertical privilege escalation through the WPshop REST API.
Affected Products
- WPshop 2 – E-Commerce plugin for WordPress, versions 2.0.0 through 2.6.0
- WordPress installations exposing the plugin's API endpoints
- E-commerce sites relying on WPshop for order and customer management
Discovery Timeline
- 2025-05-07 - CVE-2025-3853 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3853
Vulnerability Analysis
The vulnerability resides in the callback_generate_api_key() function within class-api-action.php at line 160 of the WPshop plugin. The function is exposed to authenticated users but does not verify that the requester owns the target user identifier. An attacker submits a request specifying another user's ID, and the plugin generates a valid API key bound to that account.
The issue is classified as an Insecure Direct Object Reference because the plugin trusts a client-supplied identifier without an authorization check. The generated key grants API-level access equivalent to the targeted user. If the target is an administrator or shop manager, the attacker gains privileged control over orders, customers, and store configuration.
Root Cause
The root cause is missing authorization validation on the user identifier passed to the API key generation callback. The plugin authenticates that the caller has an account, but it does not confirm that the caller is permitted to act on behalf of the identifier they submitted. WordPress capability checks such as current_user_can() are not applied against the target user context.
Attack Vector
Exploitation requires only Subscriber-level credentials, which are trivial to obtain on sites that allow open registration. The attacker sends an authenticated request to the WPshop API key generation endpoint with a target user ID belonging to a higher-privileged account. The response returns a functional API key. The attacker then uses this key to authenticate against the WPshop REST API as the victim user.
The vulnerability is exploitable over the network without user interaction. Confidentiality and integrity are affected because API access exposes customer data and allows modification of shop resources.
Detection Methods for CVE-2025-3853
Indicators of Compromise
- Unexpected API key generation events in WordPress database tables associated with the WPshop plugin
- Requests to the WPshop API key generation endpoint originating from Subscriber-role accounts
- API calls to WPshop endpoints authenticated with keys tied to administrators but originating from unfamiliar IP addresses
- New or modified user metadata containing WPshop API key values for accounts that never enabled API access
Detection Strategies
- Audit WordPress access logs for POST requests to admin-ajax.php or REST routes invoking callback_generate_api_key with a user_id parameter that does not match the session user
- Correlate API key creation timestamps with the role of the requesting account, flagging low-privilege accounts generating keys for higher-privileged users
- Monitor for anomalous session activity following API key issuance, including bulk order queries or customer data exports
Monitoring Recommendations
- Enable WordPress audit logging on the WPshop plugin and forward events to a centralized SIEM
- Alert on any creation of new Subscriber accounts followed within a short window by API key generation requests
- Track outbound API usage against the WPshop endpoints and baseline normal key-holder behavior
How to Mitigate CVE-2025-3853
Immediate Actions Required
- Update the WPshop 2 – E-Commerce plugin to a version later than 2.6.0 that addresses the missing authorization check
- Disable open user registration on affected WordPress sites until the plugin is patched
- Rotate all existing WPshop API keys and revoke keys that cannot be attributed to legitimate activity
- Review administrator and shop manager accounts for unauthorized API key entries in user metadata
Patch Information
Refer to the Wordfence Vulnerability Report for patch status and vendor updates. The vulnerable code path is documented in the WordPress Plugin Code Reference. Site administrators should upgrade to the latest available WPshop release through the WordPress plugin dashboard.
Workarounds
- Restrict access to the WPshop API key generation endpoint via web application firewall rules that block requests from Subscriber-role sessions
- Temporarily deactivate the WPshop plugin on sites that do not require its API functionality until an updated version is installed
- Enforce strong role separation and remove unnecessary Subscriber-level accounts on production e-commerce sites
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
