CVE-2025-15096
Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in Videospirecore Plugin via Email Update Abuse

Publication date: 2026-02-11

Last updated on: 2026-02-11

Assigner: Wordfence

Description
The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-11
Last Modified
2026-02-11
Generated
2026-07-06
AI Q&A
2026-02-11
EPSS Evaluated
2026-07-05
NVD
CVE-2025-15096
EUVD
EUVD-2025-207418

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
videospirecore theme_plugin to 1.0.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The 'Videospirecore Theme Plugin' for WordPress has a vulnerability that allows privilege escalation through account takeover. This happens because the plugin does not properly verify a user's identity before allowing updates to sensitive details such as email addresses.

As a result, an authenticated attacker with Subscriber-level access or higher can change the email address of any user, including administrators. By doing so, the attacker can reset the targeted user's password and gain unauthorized access to their account.

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to administrator accounts, which can lead to full site compromise.

  • Attackers can escalate their privileges from low-level user accounts to administrator accounts.
  • Attackers can take over accounts by changing email addresses and resetting passwords.
  • This can result in loss of control over the WordPress site, data breaches, and potential defacement or malicious activity.
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15096. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart