CVE-2025-13615

The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if the 'registration password fields' enabled in theme options.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.37% chance of exploitation in the next 30 days, 30th percentile

Published

2025-11-30

Updated

2026-04-08

Proof-of-concept exploits (1)

• blossombutt4063/CVE-2025-13615

References

• CVE Record
• NVD entry

Related

• CVE-2025-1361
• CVE-2025-1362
• CVE-2025-13606
• CVE-2025-1363
• CVE-2025-13597
• CVE-2025-1364