by Kastro
Paper/Archive/CVE-2025-15030

CVE-2025-15030

Unknown User Profile Builder — User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.8.448 × 209.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account

Affected

ProductAffectedFixed inSource
User Profile Builder1.1.27 – < 3.15.23.15.2CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/344cb1b1-342e-44b2-ae4a-3bb31be56b22