Password Reset Vulnerability in Ace User Management WordPress Plugin
CVE-2025-6027
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 November 2025
Badges
What is CVE-2025-6027?
The Ace User Management plugin for WordPress, in versions up to 2.0.3, contains a significant security flaw related to improper validation of password reset tokens. This vulnerability permits any authenticated user, including those with minimal roles such as subscribers, to reset the passwords of arbitrary accounts, potentially compromising sensitive accounts, including those of administrators. Without proper token validation, unauthorized users can exploit this weakness, leading to unauthorized access and control over various user accounts.
Affected Version(s)
Ace User Management 0 <= 2.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.