« Volver al listado

CVE-2025-7695

Estado: AplazadaAlta (8.8)—

The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de escalada de privilegios en endpoint REST que requiere autenticación de red (PR:L) sin validación de autorización. Permite obtener enlaces de reseteo de contraseña para cuentas administrativas, resultando en suplantación de identidad y control de cuenta.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementUser Account ManagementNetwork SegmentationMulti-factor AuthenticationDisable or Remove Feature or ProgramApplication Developer Guidance

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Dataverse Integration — Dataverse IntegrationAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-7695",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-7695",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-24T13:13:35.247159Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@wordfence.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@wordfence.com",
      "affectedData": [
        {
          "vendor": "alexacrm",
          "product": "Dataverse Integration",
          "versions": [
            {
              "status": "affected",
              "version": "2.77",
              "versionType": "semver",
              "lessThanOrEqual": "2.81"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-24T10:15:28.443",
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/integration-cds/trunk/src/API/AuthenticatedEndpoint.php",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/integration-cds/trunk/src/API/Endpoints/GetResetUserPasswordLink.php",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset?new=3329717%40integration-cds%2Ftrunk&old=3323579%40integration-cds%2Ftrunk",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://wordpress.org/plugins/integration-cds/#developers",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd35a3c-7203-4832-8b0d-56f3e7983118?source=cve",
      "source": "security@wordfence.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@wordfence.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account."
    },
    {
      "lang": "es",
      "value": "El complemento Dataverse Integration para WordPress es vulnerable a la escalada de privilegios debido a la falta de comprobaciones de autorización en su endpoint REST reset_password_link en las versiones 2.77 a 2.81. El controlador del endpoint acepta un ID, correo electrónico o nombre de usuario proporcionado por el cliente, busca a ese usuario y llama a get_password_reset_key() sin condiciones. Dado que solo comprueba que quien llama esté autenticado, y no que sea propietario o pueda editar la cuenta objetivo, cualquier atacante autenticado, con acceso de suscriptor o superior, puede obtener un enlace de restablecimiento de contraseña de un administrador y secuestrar esa cuenta."
    }
  ],
  "lastModified": "2026-06-17T10:05:29.010",
  "sourceIdentifier": "security@wordfence.com"
}