What is the CVSS score of CVE-2025-10645?

CVE-2025-10645 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-10645

MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2025-10-07 security@wordfence.com

WordPress Information Disclosure

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Oct 07, 2025 - 09:15 nvd

MEDIUM 5.3

DescriptionCVE.org

The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method when debugging is enabled (default). This makes it possible for unauthenticated attackers to extract sensitive license key and site data.

AnalysisAI

WP Reset plugin for WordPress versions up to 2.05 expose sensitive license keys and site data through unauthenticated access to the WF_Licensing::log() method when debugging is enabled by default. Remote attackers can extract confidential information including license credentials without authentication, creating a direct pathway to account compromise and unauthorized access to site administration features. No public exploit code or active exploitation has been confirmed, but the low attack complexity and default dangerous configuration significantly elevate real-world risk.

Technical ContextAI

The WP Reset plugin uses a WF_Licensing class with a log() method that writes sensitive data (license keys, site identifiers) to debug logs accessible via HTTP requests. CWE-532 (Insertion of Sensitive Information into Log File) describes the root cause: the application logs authentication credentials and other sensitive identifiers in a format and location that can be retrieved by attackers. The vulnerability is enabled by WordPress's default WP_DEBUG setting when active, and the plugin fails to implement proper access controls (authentication checks) or output encoding on the debug log endpoint. The default-enabled debugging configuration means most affected installations are vulnerable without additional misconfiguration required.

Affected ProductsAI

WP Reset plugin for WordPress, all versions up to and including 2.05, affects any WordPress installation with the plugin active and debugging enabled (CWE-532 in CPE context would be wp:reset_plugin:*:*). The vulnerability is confirmed by Wordfence threat intelligence and documented in the WordPress plugins repository changeset 3364169. WordPress 5.0 and later are the typical deployment target, though the plugin itself operates independently of WordPress core version.

RemediationAI

Upgrade WP Reset plugin to version 2.06 or later, which addresses the WF_Licensing::log() information exposure by implementing proper authentication checks and disabling sensitive data logging in debug output. Immediate workaround: disable WordPress debug logging (set WP_DEBUG to false in wp-config.php) and restrict access to debug.log files via .htaccess or web server configuration if WP_DEBUG cannot be disabled. Verify no cached or historical debug logs containing license keys remain accessible. See WordPress plugins repository changeset 3364169 and Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/86741f4a-8700-45dd-8998-b3f0387c27ed for additional mitigation steps.