CVE-2025-25171CWE-288

WordPress WP SmartPay plugin <= 2.7.13 - Account Takeover vulnerability

High · published June 27, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

Authentication Bypass Using an Alternate Path or Channel vulnerability in Convers Lab WP SmartPay smartpay allows Authentication Abuse.This issue affects WP SmartPay: from n/a through <= 2.7.13.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.0th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2025-06-27T11:52Z
EPSS history
Timeline
  • 27 JUN 11:52Z
    WordPress WP SmartPay plugin <= 2.7.13 - Account Takeover vulnerability
    cvelistv5