Access violation vulnerability in Reales WP STPT 2.1.2

The Reales WP STPT plugin for WordPress has a security issue where attackers can gain unauthorized access to user accounts. This is because the plugin does not properly check a user’s identity before allowing them to change their password or email address. This means that attackers with subscriber-level access or higher can change the passwords and email addresses of any user, including administrators. This vulnerability can also be used in combination with another security issue (CVE-2025-3609) to gain remote access to the account.