Unauthorized Data Access in PeproDev Ultimate Profile Solutions for WordPress

CVE-2025-3924

What is CVE-2025-3924?

The PeproDev Ultimate Profile Solutions plugin for WordPress contains a vulnerability that allows unauthorized access to user data through an exposed reset-password endpoint. By utilizing the username parameter without sufficient validation, the plugin fails to ensure that the requestor is affiliated with the specified user account. This flaw permits unauthenticated attackers to gather email addresses associated with any user, including those of administrators, thereby posing a significant risk to user privacy and account security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References