The Shopper Approved Reviews plugin for WordPress, specifically versions 2.0 and 2.1, contains a critical vulnerability identified as CVE-2025-3063. This vulnerability is classified under CWE-862 (Missing Authorization) and arises because the ajax_callback_update_sa_option() function lacks proper capability checks. As a result, any authenticated user with at least Subscriber-level privileges can invoke this AJAX callback to update arbitrary options within the WordPress site. The exploit path involves modifying the 'default_role' option to 'administrator' and enabling user registration, which allows an attacker to create new administrative accounts without legitimate authorization. This effectively leads to privilege escalation from a low-privilege user to a full administrator, compromising the entire site. The vulnerability is remotely exploitable over the network without requiring user interaction beyond authentication, and it affects the confidentiality, integrity, and availability of the affected WordPress installations. The CVSS v3.1 base score is 8.8, reflecting high severity due to the ease of exploitation and the critical impact on site security. No patches or official fixes are currently linked, and no active exploits have been reported in the wild as of the publication date.

The exploitation of CVE-2025-3063 can have severe consequences for organizations running the affected Shopper Approved Reviews plugin. Attackers gaining administrative access can fully control the WordPress site, leading to data breaches, defacement, malware implantation, or use of the site as a pivot point for further network attacks. Confidentiality is compromised as sensitive user and business data may be accessed or exfiltrated. Integrity is at risk because attackers can alter site content, configurations, and user roles. Availability may also be impacted if attackers disrupt site operations or deploy ransomware. Given WordPress's widespread use globally, this vulnerability can affect a broad range of organizations, from small businesses to large enterprises relying on Shopper Approved Reviews for customer feedback. The ease of exploitation by low-privilege authenticated users increases the risk, especially in environments where user registration or subscriber accounts are common or where insider threats exist.

Organizations should immediately audit their WordPress sites for the presence of the Shopper Approved Reviews plugin versions 2.0 and 2.1 and disable or remove the plugin if patching is not yet available. If possible, restrict user registration and limit Subscriber-level accounts to trusted users only. Implement strict access controls and monitor for unusual changes to WordPress options, especially the 'default_role' setting. Employ Web Application Firewalls (WAFs) with custom rules to detect and block unauthorized AJAX requests targeting the vulnerable function. Regularly review user roles and permissions to detect unauthorized privilege escalations. Additionally, consider isolating WordPress administrative interfaces behind VPNs or IP whitelisting to reduce exposure. Stay alert for official patches or updates from the vendor and apply them promptly once released. Conduct security awareness training to reduce risks from insider threats or compromised low-privilege accounts.