CVE-2025-6027

CVE-2025-6027CVE-2025-6027

Description

The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.

Scoring

CVSS 6.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Last modified2026-10-19
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.