by Kastro
Paper/Archive/CVE-2025-5305

CVE-2025-5305

Unknown Password Reset with Code for WordPress REST API — Password Reset with Code < 0.0.17 - Insecure Password Reset Code Creation

EPSS 0.2%public exploitCVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 15.6.156 × 203.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers.

Affected

ProductAffectedFixed inSource
Password Reset with Code for WordPress REST API< 0.0.170.0.17CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/dcf5c003-91b0-4e7d-89f3-7459d8f01153