CVE-2025-15030: 
WordPress vulnerability analysis and mitigation

CVE-2025-15030 is an unauthenticated arbitrary password reset vulnerability in the User Profile Builder WordPress plugin affecting versions before 3.15.2. The flaw allows an unauthenticated attacker to reset the password of any WordPress user — including administrators — by knowing only their username, thereby gaining full account access. It was publicly disclosed on January 12, 2026, and assigned a CVSS v3.1 base score of 9.8 (Critical) (WPScan, Feedly). The vulnerability was discovered and reported by Drew Webber (mcdruid) (WPScan).

The root cause is an improper password reset workflow (CWE-269: Improper Privilege Management) in the User Profile Builder plugin's handling of the WordPress password reset flow. The plugin fails to properly validate or bind the reset key to a legitimate server-generated token, allowing an attacker to supply an arbitrary key value (e.g., hacked) in the initial reset request and then immediately use that same attacker-controlled key to complete the password reset — bypassing the email verification step entirely. Exploitation requires only knowledge of a valid username (e.g., admin) and can be completed in a small number of unauthenticated HTTP requests. A public proof-of-concept Python script is available via WPScan and GitHub demonstrating the full attack chain (WPScan, PoC GitHub).

Successful exploitation grants an unauthenticated attacker full administrative access to the affected WordPress installation, enabling complete site compromise. Consequences include unauthorized content modification, malware or backdoor injection, theft of sensitive user data stored in the WordPress database, and potential lateral movement within the hosting infrastructure. All three security pillars are affected: confidentiality (data theft), integrity (content/code modification), and availability (site defacement or takedown) (WPScan, Feedly).

A public proof-of-concept exploit script is available on WPScan and GitHub (added March 2, 2026), making exploitation accessible to low-skilled attackers (WPScan, PoC GitHub). As of the latest available intelligence, there is no confirmed evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.005% (very low), and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify WordPress sites running the User Profile Builder plugin (versions before 3.15.2) using tools like WPScan, Shodan, or by checking /wp-content/plugins/profile-builder/ paths. Enumerate valid usernames (e.g., admin) via WordPress's default username enumeration or the login error messages.
2. Initiate password reset with attacker-controlled key: Send a POST request to https://target.com/wp-login.php?action=lostpassword with the body user_login=admin&user_pass=hacked&wp-submit=Get+New+Password. The plugin improperly accepts the attacker-supplied user_pass value as the reset key.
3. Access the reset link with the known key: Send a GET request to https://target.com/wp-login.php?action=rp&key=hacked&login=admin. Because the plugin stored the attacker-controlled key, this request is accepted.
4. Set a new password: Send a POST request to https://target.com/wp-login.php?action=resetpass with body pass1=NewPassword123&pass2=NewPassword123&pw_weak=on&rp_key=hacked&wp-submit=Save+Password. The server responds with a success message confirming the password has been reset.
5. Log in as administrator: Use the newly set credentials (admin / NewPassword123) to authenticate to the WordPress admin panel and achieve full site control (WPScan, PoC GitHub).

• Network: Multiple sequential POST/GET requests to /wp-login.php?action=lostpassword, /wp-login.php?action=rp, and /wp-login.php?action=resetpass from the same IP address within a short time window, particularly without a preceding legitimate email-based reset flow.
• Logs: WordPress access logs showing requests to the password reset endpoints with unusual or static key parameter values (e.g., key=hacked) not matching server-generated tokens; rapid succession of reset requests for high-privilege accounts (e.g., admin).
• Logs: Successful password change events in WordPress authentication logs for administrator accounts not initiated by the account owner, especially from unfamiliar IP addresses.
• File System: New or modified PHP files in the WordPress installation directory (e.g., web shells) following a successful account takeover.
• Process/Behavior: Unexpected new administrator accounts created, plugin/theme installations from unknown sources, or changes to site settings shortly after suspicious reset activity (WPScan).

The vendor has released a fix in User Profile Builder version 3.15.2; all site operators should update immediately via the WordPress plugin dashboard or by downloading the patched version (WPScan). If immediate patching is not feasible, consider temporarily deactivating the plugin or using a Web Application Firewall (WAF) rule to block sequential requests to the WordPress password reset endpoints (/wp-login.php?action=lostpassword, action=rp, action=resetpass) from the same source IP. Additionally, review WordPress administrator account activity logs for any unauthorized password changes and reset credentials for all privileged accounts as a precaution (Feedly).

The vulnerability received coverage from security aggregators and community accounts on Mastodon and Bluesky shortly after disclosure (Feedly). Wordfence included it in their weekly WordPress vulnerability report for the week of January 12–18, 2026, highlighting its critical severity (Wordfence). No major vendor statements beyond the WPScan advisory and patch release have been identified.