CVE-2025-14975
BaseFortify
Publication date: 2026-01-29
Last updated on: 2026-01-29
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| custom_login_page_customizer | custom_login_page_customizer | to 2.5.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the WordPress plugin Custom Login Page Customizer versions before 2.5.4. It is caused by an improper password reset process that allows unauthenticated attackers to reset the password of any user, including administrators, by knowing only their username. This lets attackers gain unauthorized access to user accounts without needing to authenticate. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to user accounts, including administrator accounts, by allowing attackers to reset passwords without authentication. This can result in privilege escalation, loss of control over the website, potential data breaches, and unauthorized actions performed by attackers within the compromised accounts. [1]
What immediate steps should I take to mitigate this vulnerability?
Update the Custom Login Page Customizer WordPress plugin to version 2.5.4 or later, as this version contains the fix for the improper password reset process vulnerability. This update prevents unauthenticated attackers from resetting passwords by knowing usernames and gaining unauthorized access. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated attackers to reset passwords and gain unauthorized access to user accounts, including administrators. Such unauthorized access can lead to data breaches and compromise sensitive personal or health information, thereby negatively impacting compliance with standards like GDPR and HIPAA that require protection of user data and secure authentication mechanisms. [1]