CVE-2025-6027: 
WordPress vulnerability analysis and mitigation

The Ace User Management WordPress plugin version 2.0.3 and earlier contains an authentication bypass vulnerability (CVE-2025-6027). The vulnerability was discovered and publicly disclosed on October 15, 2025. The issue affects the password reset functionality of the plugin, which fails to properly validate password reset tokens (WPScan).

The vulnerability stems from improper validation of password reset tokens. The plugin does not correctly verify that a password reset token is associated with the specific user who requested it. This implementation flaw allows authenticated users, including those with subscriber-level access, to reset passwords for arbitrary accounts, including administrator accounts. The vulnerability has been assigned a CVSS score of 8.8 (High), indicating significant security impact (WPScan).

The vulnerability allows authenticated attackers to reset passwords for any user account in the system, including administrative accounts. This can lead to complete account takeover and unauthorized access to privileged functionality within WordPress installations using the affected plugin (WPScan).