The Reales WP STPT plugin for WordPress allows authenticated attackers with subscriber or higher privileges to update the passwords and email addresses of any user, including administrators, because the plugin fails to verify the identity of the requestor before making the changes. This flaw leads to a full account takeover and can be exploited to gain control of administrative accounts, resulting in a compromise of the entire WordPress site. The weakness is mapped to CWE‑639, Insufficient Verification of User Credentials.

All installations of the Reales WP STPT plugin by pixel_prime that use version 2.1.2 or older are affected. The issue exists in WordPress sites running these plugin versions, regardless of the overall WordPress core version.

The vulnerability has a CVSS score of 8.8 and an EPSS score of 1%, indicating a high severity and a low but non‑zero probability of exploitation. Because the attack vector requires an authenticated user with at least subscriber privileges, an attacker first needs to obtain valid credentials or be a legitimate user. Once authenticated, the attacker can change any user's password and email address, enabling them to take over administrative accounts. Additionally, when combined with CVE‑2025‑3609, a remote code execution path becomes possible for an unauthenticated user. The flaw is not listed in CISA’s KEV catalog.