CVE-2025-15096

Name of the Vulnerable Software and Affected Versions Videospirecore Theme Plugin versions prior to 1.0.7

Description The 'Videospirecore Theme Plugin' for WordPress is susceptible to privilege escalation, potentially leading to account takeover. The issue arises from insufficient validation of a user’s identity before allowing updates to user details, such as email addresses. Authenticated attackers with Subscriber-level access or higher can modify the email addresses of any user, including administrators, and subsequently reset passwords to gain unauthorized access to accounts.

Recommendations Update the Videospirecore Theme Plugin to version 1.0.7 or later.