CVE-2025-3793 is a vulnerability in the Buddypress Force Password Change plugin for WordPress, affecting all versions up to 0.1. The issue arises because the plugin does not properly verify the identity of a user before allowing a password update via the 'bp_force_password_ajax' function. Authenticated attackers with subscriber-level privileges or higher can exploit this to change passwords of arbitrary users, including administrators, leading to potential account takeover. The vulnerability is categorized under CWE-620 and has a CVSS score of 4.2, reflecting a medium impact with network attack vector, high attack complexity, low privileges required, no user interaction, and low confidentiality and integrity impacts.

An authenticated attacker with subscriber-level access or higher can change the passwords of other users, including administrators, without proper identity verification. This can lead to account takeover and unauthorized access to privileged accounts. The confidentiality and integrity impacts are rated low, and availability is not affected. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict plugin usage to trusted users only or consider disabling the plugin to prevent exploitation.