CVE-2025-10645: 
WordPress vulnerability analysis and mitigation

CVE-2025-10645 is a Sensitive Information Exposure vulnerability in the WP Reset plugin for WordPress, classified under CWE-532 (Insertion of Sensitive Information into Log File). It affects all versions of WP Reset up to and including 2.05, where the WF_Licensing::log() method writes sensitive data to log files when debugging is enabled — which is the default configuration. Unauthenticated remote attackers can exploit this to extract license keys and site data. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Red Hat CVE).

The root cause is CWE-532: Insertion of Sensitive Information into Log File. The WF_Licensing::log() method in WP Reset records sensitive data — including license keys and site-specific information — into log files when the plugin's debug mode is active. Because debug mode is enabled by default, this condition exists on most installations without any additional attacker-controlled configuration. Since the log files may be accessible via the web root or through directory traversal, unauthenticated attackers with network access can retrieve this data without any authentication or elevated privileges (Feedly, Wordfence).

Successful exploitation allows unauthenticated attackers to read sensitive license key and site configuration data stored in debug log files. The confidentiality impact is low in scope — there is no integrity or availability impact — but exposed license keys could be used to abuse plugin licensing systems or gather reconnaissance data about the target WordPress installation. The vulnerability does not directly enable code execution or privilege escalation, but the exposed information could facilitate further attacks (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-10645. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable if an attacker can access the log file path (Feedly, Wordfence).

1. Reconnaissance: Identify WordPress sites running the WP Reset plugin (version ≤ 2.05) using passive techniques such as checking /wp-content/plugins/wp-reset/ for plugin presence or using tools like WPScan.
2. Locate the log file: Determine the default log file path used by the WF_Licensing::log() method within the WP Reset plugin directory (typically under /wp-content/plugins/wp-reset/ or a writable uploads directory).
3. Request the log file: Send an unauthenticated HTTP GET request directly to the log file URL (e.g., https://target.com/wp-content/plugins/wp-reset/<logfile>.log) to retrieve its contents.
4. Extract sensitive data: Parse the retrieved log file for license keys, site URLs, and other configuration data that can be used for further reconnaissance or license abuse (Feedly, Wordfence).

• Network: Unusual unauthenticated HTTP GET requests to log file paths within /wp-content/plugins/wp-reset/ (e.g., requests for .log files from external IPs).
• Logs: Web server access logs showing direct requests to plugin log files by unknown or automated user agents; repeated access attempts to the WP Reset plugin directory.
• File System: Presence of debug log files in the WP Reset plugin directory containing license key strings or site data; unexpected read access timestamps on log files.

Users should update the WP Reset plugin to a version beyond 2.05 that addresses this vulnerability. As an immediate workaround, administrators can disable debug/logging mode in the WP Reset plugin settings to prevent sensitive data from being written to log files. Additionally, web server configuration should be updated to block direct HTTP access to .log files within the WordPress plugin directories (e.g., via .htaccess rules denying access to *.log files). Existing log files should be reviewed and deleted if they contain sensitive information (Feedly, Wordfence).

Wordfence included CVE-2025-10645 in their weekly WordPress vulnerability report for October 6–12, 2025, flagging it as a medium-severity information disclosure issue. Sucuri also referenced it in their October 2025 vulnerability patch roundup. No significant researcher commentary or social media debate has been observed beyond standard vulnerability tracking and aggregation (Wordfence, Sucuri Blog).