Unauthorized Data Access in PeproDev Ultimate Profile Solutions for WordPress
CVE-2025-3924
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 May 2025
What is CVE-2025-3924?
The PeproDev Ultimate Profile Solutions plugin for WordPress contains a vulnerability that allows unauthorized access to user data through an exposed reset-password endpoint. By utilizing the username parameter without sufficient validation, the plugin fails to ensure that the requestor is affiliated with the specified user account. This flaw permits unauthenticated attackers to gather email addresses associated with any user, including those of administrators, thereby posing a significant risk to user privacy and account security.
Affected Version(s)
PeproDev Ultimate Profile Solutions 1.9.1 <= 7.5.2