Cross-Site Request Forgery Vulnerability in Emergency Password Reset Plugin by Andy Moyle
CVE-2025-57942

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Emergency Password Reset
Vendor
CVE Published:
22 September 2025

What is CVE-2025-57942?

The Emergency Password Reset plugin developed by Andy Moyle is susceptible to Cross-Site Request Forgery (CSRF) attacks, which could allow an attacker to execute unauthorized actions on behalf of an authenticated user. This vulnerability could potentially expose sensitive user data and disrupt the security of affected websites. Users are advised to review their implementations and apply necessary security measures.

Affected Version(s)

Emergency Password Reset 0 <= 9.3

References

https://patchstack.com/database/Wordpress/Plugin/emergenc...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan (Patchstack Alliance)
.