CVE-2025-15030

The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account

Score

CVSS 3.1 9.8 Critical

Status

Deferred - contact@wpscan.com

Published

2026-02-02

Last modified

2026-02-02

Weaknesses

CWE-269

Affected products

• User Profile Builder (Unknown)

References

• https://wpscan.com/vulnerability/344cb1b1-342e-44b2-ae4a-3bb31be56b22/