{"vulnerability": "cve-2025-3853", "sightings": [{"uuid": "476fab36-d9bf-4d75-b081-3c96de7c8c9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-3853", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lokkl3sjfo2l", "content": "", "creation_timestamp": "2025-05-07T04:26:18.178451Z"}, {"uuid": "f2778cee-52a5-4b9b-bbad-b61173e99269", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "cve-2025-38532", "type": "seen", "source": "https://bsky.app/profile/Android.activitypub.awakari.com.ap.brid.gy/post/3lxxoddlkol22", "content": "", "creation_timestamp": "2025-09-03T22:25:26.128964Z"}, {"uuid": "880ea3a5-ac16-43be-a227-5d3a10221826", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-38531", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "72906acf-57d5-4157-b783-4cea9eb648c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-38531", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8", "content": "", "creation_timestamp": "2025-12-03T14:14:49.267740Z"}, {"uuid": "7836931e-ea1f-48e6-8c9d-464d83e0797b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-38535", "type": "seen", "source": "Telegram/hJTfcx4e0m6EfcFVnO3jT9hnn52auvn9Rlc8cXvS590j6io", "content": "", "creation_timestamp": "2026-01-07T19:08:15.000000Z"}, {"uuid": "503d7a45-bdb0-4b3a-bb5d-944ba73531d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-38530", "type": "seen", "source": "Telegram/Ju8JfUjH9zqeraQNJp_KORHTFVyuyI7eY029BUOqxvCU9FY", "content": "", "creation_timestamp": "2026-01-07T19:07:58.000000Z"}, {"uuid": "c06cb9e1-bcfa-42aa-93d4-c3f560a75a03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-38538", "type": "seen", "source": "Telegram/hJTfcx4e0m6EfcFVnO3jT9hnn52auvn9Rlc8cXvS590j6io", "content": "", "creation_timestamp": "2026-01-07T19:08:15.000000Z"}, {"uuid": "139edd1d-8f9a-4fe3-97ab-00e9e60b1342", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-38535", "type": "seen", "source": "Telegram/Ju8JfUjH9zqeraQNJp_KORHTFVyuyI7eY029BUOqxvCU9FY", "content": "", "creation_timestamp": "2026-01-07T19:07:58.000000Z"}, {"uuid": "ca021e5e-0db6-47cc-abc9-c672c111b896", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-3853", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15249", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-3853\n\ud83d\udd25 CVSS Score: 6.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)\n\ud83d\udd39 Description: The WPshop 2 \u2013 E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.\n\ud83d\udccf Published: 2025-05-07T01:43:06.033Z\n\ud83d\udccf Modified: 2025-05-07T01:43:06.033Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/136d63c4-c985-413f-8d8b-b57e11d1d230?source=cve\n2. https://plugins.trac.wordpress.org/browser/wpshop/tags/2.6.0/modules/api/action/class-api-action.php#L160", "creation_timestamp": "2025-05-07T02:21:45.000000Z"}, {"uuid": "c541edb4-094f-43fe-b2ef-8d5908a8e720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-3853", "type": "seen", "source": "https://t.me/cvedetector/24665", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-3853 - WordPress WPshop E-Commerce Plugin Insecure Direct Object Reference Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-3853 \nPublished : May 7, 2025, 3:15 a.m. | 1\u00a0hour, 12\u00a0minutes ago \nDescription : The WPshop 2 \u2013 E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users. \nSeverity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"07 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-05-07T07:12:46.000000Z"}]}