CVE-2025-15030: User Profile Builder WordPress Plugin Improper Password Reset Authentication Bypass

Overview

The User Profile Builder plugin for WordPress, in versions before 3.15.2, has a weak password reset process. According to the record, a small number of unauthenticated requests can reset the password of any user if the attacker knows the username, including administrator accounts. The weakness is classified as CWE-269 (Improper Privilege Management). The CNA entry is from WPScan, and the detailed vulnerability entry is available at WPScan.

Impact

• The record describes a path to account takeover without authentication.
• Because administrator accounts can be targeted, the potential consequences include control of site content, configuration and other users.
• The CVSS 3.1 base score given in the record is 9.8 (critical), with high confidentiality, integrity and availability impact and no privileges or user interaction required.

Affected products and versions

• Product: User Profile Builder plugin for WordPress.
• Affected versions: versions before 3.15.2, as stated in the record description.
• The record's affected list is empty, so the exact list of impacted version ranges beyond this boundary is unknown from the data provided.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by that source. No confirmed exploitation appears in the sources consulted. The EPSS score is not available in the record.

Remediation and mitigation

• Update the User Profile Builder plugin to version 3.15.2 or later, which is the version boundary given in the record. The record does not list an explicit fixed version, so confirm the update with the vendor or the WPScan entry.
• If an update cannot be applied immediately, consider temporarily disabling the plugin or restricting access to its password reset functionality at the perimeter, while recognizing that this may affect users.
• After patching, review administrator and privileged accounts and rotate credentials where there is any doubt about unauthorized changes.
• Enforce strong, unique passwords and multi-factor authentication for administrative accounts.

Detection guidance

• Review web server and WordPress logs for unexpected password reset requests, particularly those targeting administrator usernames.
• Look for successful logins to administrative accounts from unfamiliar sources or at unusual times.
• Audit recent changes to user accounts, roles and site settings for signs of unauthorized modification.

Limitations of the available information

• The record does not include a vendor advisory, a list of affected versions beyond the stated boundary, or a confirmed fixed release.
• The EPSS score and SSVC data are absent.
• The source status in the record is Deferred, and the reason for that status is unknown.
• Whether the plugin was exploited in practice is unknown from the sources consulted.

Frequently asked questions

What is CVE-2025-15030?

It is a flaw in the User Profile Builder WordPress plugin before 3.15.2, where the password reset process can be abused without authentication to reset passwords of users whose usernames are known, including administrators.

Is this vulnerability being actively exploited?

The record shows that the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What should site owners do?

Update the User Profile Builder plugin to version 3.15.2 or later, review administrator accounts for unauthorized changes, and enforce strong passwords and multi-factor authentication.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.