CVE-2025-14975

Custom Login Page Customizer < 2.5.4 - Unauthenticated Arbitrary Password Reset

The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account

Affected

Custom Login Page Customizer

CVSS v3.1 CNA

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.34% chance of exploitation in the next 30 days, 26th percentile

Published

2026-01-29

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a1403186-51aa-4eae-a3fe-0c559570eb93/

References

• CVE Record
• NVD entry