Privilege escalation in Eoxia Wpshop 2 – E-commerce
CVE-2025-3852
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like…
Vulnerability class: Privilege Escalation
EPSS: 0.003 (56.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Eoxia Wpshop 2 – E-commerce — versions 2.0.0
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/96b8186c-dfe9-4137-b28d-cc09a…
- plugins.trac.wordpress.org/browser/wpshop/tags/2.6.0//core/external/eo-framewor…
- plugins.trac.wordpress.org/browser/wpshop/tags/2.6.0/core/external/eo-framework…
- plugins.trac.wordpress.org/browser/wpshop/tags/2.6.0//modules/api/action/class-…
Frequently asked questions
- What is CVE-2025-3852?
- CVE-2025-3852 is a high-severity vulnerability in Eoxia Wpshop 2 – E-commerce, classified under Improper Privilege Management. CVSS score: 8.8/10. Published 2025-05-07.
- How severe is CVE-2025-3852?
- High severity. CVSS v3 base score is 8.8 out of 10.