CVE-2025-3063

CVE-2025-3063 describes a privilege escalation vulnerability in the Shopper Approved Reviews plugin for WordPress, affecting versions 2.0 to 2.1. This flaw, stemming from a missing capability check, allows authenticated users with subscriber-level access or higher to modify arbitrary WordPress options. Attackers can exploit this to enable user registration and set the default role to administrator, thereby gaining full administrative control over the site. Rated with a CVSS score of 8.8 (HIGH), this vulnerability is easily exploitable over the network with low privileges and no user interaction, leading to high impacts on confidentiality, integrity, and availability. The FAUCET Risk Score is 83/100, indicating significant risk. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. While there is limited community discussion and media coverage, the vulnerability is not listed on the CISA KEV catalog or any hot lists.