EUVD-2026-75241
GHSA-c66v-c2xg-68hr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber-level WordPress account
-
DeliveryCall plugin endpoint to overwrite admin email address
-
ExploitTrigger WordPress forgot-password for admin username
-
ExecutionReceive reset token at attacker-controlled inbox
-
PersistReset admin password via token
-
ImpactLog in as full site administrator
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Bulk Password Reset plugin must be installed and active on the WordPress site. The attacker must hold at minimum a subscriber-level WordPress account on the target site - either obtained via open user registration or through a pre-existing low-privilege credential. No special plugin configuration or non-default settings are required beyond having the plugin active; the authorization flaw exists in the plugin's default operational state. Exploitation is limited to WordPress environments running this specific plugin at version 1.3.3 or earlier; sites that have disabled user registration AND have no existing untrusted low-privilege accounts are not exposed to external attackers, though the vulnerability remains present in the code. |
| Impact | The provided CVSS 3.1 score of 8.0 with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity, low-privilege attack with full CIA impact. The UI:R metric is questionable: in the described attack chain, the victim administrator takes no action - only the attacker interacts with the reset email sent to their own controlled inbox. A UI:N assignment appears more accurate and would raise the score to approximately 8.8. No EPSS data was provided and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. However, the barrier to exploitation is extremely low: any WordPress account - including freely self-registered subscriber accounts if site registration is open - is sufficient to compromise the entire site. The availability of Wordfence's detailed advisory and direct source code line references makes independent exploit development straightforward, increasing real-world risk beyond what EPSS alone would indicate. |
| Exploit ScenarioDerived | An attacker self-registers a free subscriber account on a target WordPress site that has the Bulk Password Reset plugin installed. The attacker calls the plugin's unprotected user-update endpoint to change the site administrator's registered email address to an attacker-controlled inbox, then triggers a standard WordPress password-reset for that admin username. The reset link arrives in the attacker's inbox; clicking it grants full administrative access to the WordPress site without the legitimate admin ever being aware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.
RemediationAI
No vendor-released patched version has been identified in the available data; version 1.3.3 remains the latest tagged release and is confirmed vulnerable. Site administrators should immediately deactivate and remove the Bulk Password Reset plugin until a patched release is available. As a compensating control, restrict WordPress user registration to prevent untrusted parties from obtaining subscriber accounts, which eliminates the PR:L entry point for unauthenticated external attackers - though this does not protect against already-registered low-privilege users. Additionally, review all existing subscriber-level and contributor-level accounts for legitimacy. Monitor the WordPress.org plugin page and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/93237020-435f-41a6-bcca-fe7b605723ae for patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Bulk Password Reset plugin (CPE: cpe:2.3:a:rubenw:bulk_password_reset:*:*:*:*:*:*:*:*) provides WordPress site administrators a mass-credential-rotation facility. The root cause is CWE-862 (Missing Authorization): the plugin's AJAX/REST handlers that update user email addresses and passwords do not verify that the authenticated requester has sufficient privilege to modify the target account. WordPress's role hierarchy means a subscriber (the lowest authenticated role) can reach these endpoints and target higher-privilege accounts. The attack exploits the normal WordPress forgot-password flow as a second stage: once the admin's registered email is replaced, a standard password-reset request delivers the reset token to the attacker rather than the legitimate admin.
Know when Bulk Password Reset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
UI:N corrected from provided UI:R because only the attacker interacts with the reset email, not the victim administrator.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Articles & Coverage 1
Executive ViewAI
Bulk Password Reset plugin versions 1.3.3 and earlier allow any authenticated WordPress user to escalate to full administrative control by modifying admin email addresses and forcing password resets. Organizations running this plugin face unauthorized administrative access, enabling complete site compromise, data theft, and malware deployment.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the plugin entirely to eliminate the exploit vector; restrict WordPress subscriber user role assignment to trusted administrators only; enable and monitor WordPress security audit logs for email address and password reset events; implement Web Application Firewall rules limiting administrative function access to authorized IP address ranges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB