Home

Description

The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account

PUBLISHED Reserved 2025-12-22 | Published 2026-02-02 | Updated 2026-02-02 | Assigner WPScan

Problem types

CWE-269 Improper Privilege Management

Product status

Default status
unaffected

1.1.27 (semver) before 3.15.2
affected

Credits

Drew Webber (mcdruid) finder

WPScan coordinator

References

wpscan.com/...rability/344cb1b1-342e-44b2-ae4a-3bb31be56b22/ exploit vdb-entry technical-description

cve.org (CVE-2025-15030)

nvd.nist.gov (CVE-2025-15030)

Download JSON