CVE-2025-3452

Summary

CVE-2025-3452 is a vulnerability affecting the SecuPress Free WordPress Security plugin. This issue allows authenticated attackers with Subscriber-level access or higher to bypass capability checks on the 'secupress_reinstall_plugins_admin_ajax_cb' function, enabling them to install arbitrary plugins on vulnerable WordPress sites. The vulnerability exists in all versions up to and including 2.3.9. This security flaw poses a significant risk, as it can compromise the integrity of the WordPress installation. Plugin users are advised to update to the latest version of SecuPress to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.