Dataverse Integration
Approved changes feed: RSS · Atom
cpe:2.3:a:alexacrm:dataverse_integration:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Alexacrm (6b06e65c-5279-597e-847f-55d4e9bc50b5) |
|---|---|
| Product | Dataverse Integration (6f0ac6ae-b4b3-563f-90c4-e1c6ba6070f6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-7695 |
vulnerable | 2026-06-08 07:45:17.984229 |
Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route
HIGH (8.8)
The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account.
Published: 2025-07-24T09:22:21.270Z
Updated: 2025-07-24T13:13:39.837Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.