CVE-2025-15030

CWE-269 — Improper Privilege Management5 documents5 sources
Severity
9.8CRITICAL
EPSS
0.0%
top 94.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Unknown User Profile Builder
Timeline
PublishedFeb 2

Description

The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶CVEListV5unknown/user_profile_builder1.1.27 — 3.15.2

🔴Vulnerability Details

3
GHSA
GHSA-hgq7-79qc-3jhq: The User Profile Builder WordPress plugin before 3↗2026-02-02
▶
CVEList
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset↗2026-02-02
▶
VulnCheck
cozmoslabs profile_builder Improper Privilege Management↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-15030 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-15030 (CRITICAL CVSS 9.8) | The User Profile Builder WordPress | cvebase.io