CVE-2025-15030

User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset

The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account

Affected

User Profile Builder

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.54% chance of exploitation in the next 30 days, 44th percentile

Published

2026-02-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/344cb1b1-342e-44b2-ae4a-3bb31be56b22/

References

• CVE Record
• NVD entry