CVE-2025-15096 is an authorization bypass vulnerability in the Videospirecore Theme Plugin for WordPress, caused by insufficient validation of user identity before updating user details such as email addresses. This flaw permits authenticated attackers with low-level privileges (Subscriber or above) to modify email addresses of arbitrary users, including administrators. By changing an administrator's email, attackers can trigger password reset processes to take over the account, resulting in privilege escalation. The vulnerability is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 score of 8.8, indicating high severity. No vendor patch or remediation guidance is currently provided.

Successful exploitation allows an authenticated low-privilege user to escalate privileges by taking over administrator accounts through email address manipulation and password reset. This compromises confidentiality, integrity, and availability of the affected WordPress site, potentially leading to full site takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious account changes. Avoid using the affected plugin versions if possible.