← CVE Intelligence

CVE-2025-14975

Custom Login Page Customizer < 2.5.4 - Unauthenticated Arbitrary Password Reset PUBLISHED

Description (CNA)

The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account

Affected (CNA)

Vendor / productVersions
Unknown / Custom Login Page Customizeraffected 2.1.1 before 2.5.4

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.