CVE-2025-3793

Summary

CVE-2025-3793 is a vulnerability affecting the Buddypress Force Password Change plugin for WordPress. This issue allows authenticated attackers, with subscriber-level access and above, to manipulate the 'bp_force_password_ajax' function, which can be exploited to change arbitrary user passwords, including administrator accounts, without proper validation of the authenticating user's identity. This authenticated account takeover vulnerability poses a significant threat, allowing attackers to gain unauthorized access to sensitive user accounts. Versions of the plugin up to and including 0.1 are reportedly affected by this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.