Vulnerability · Published Apr 24, 2025 · Assigned by Wordfence

CVE-2025-3793Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update

Medium 4.2

In plain English

A medium-severity security flaw in Buddypress Force Password Change from lamarant. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 86.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bp_force_password_ajax' function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with subscriber-level access and above and under certain prerequisites, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their accounts.

Affected products (as reported)

Vendor	Product	Versions
lamarant	Buddypress Force Password Change	0 – through 0.1

Weakness: CWE-620 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References