{"id":"CVE-2025-6027","aliases":["EUVD-2025-37794","GHSA-v22x-qm55-p7pm"],"status":"published","title":"Ace User Management \u003c= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest","description":"The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0019,"percentile":0.08692,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2025-11-05T06:00:07Z","modified":"2026-10-19T13:10:00Z","products":[{"vendor":"unknown","product":"ace user management"}],"references":[{"url":"https://wpscan.com/vulnerability/06fb8088-10e3-424e-a3ac-4673bac49467/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6027"},{"url":"https://wpscan.com/vulnerability/06fb8088-10e3-424e-a3ac-4673bac49467"},{"url":"https://github.com/advisories/GHSA-v22x-qm55-p7pm"}],"sources":{"cve":[{"id":"CVE-2025-6027","title":"Ace User Management \u003c= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest","description":"The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.","status":"published","published":"2025-11-05T06:00:07.919Z","modified":"2026-04-02T12:39:55.948Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:40.774223Z"}],"euvd":[{"id":"EUVD-2025-37794","description":"The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.","status":"published","published":"2025-11-05T06:00:07Z","modified":"2026-04-02T12:39:55Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:25:23.121433Z"}],"ghsa":[{"id":"GHSA-v22x-qm55-p7pm","title":"The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password...","description":"The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.","status":"published","published":"2025-11-05T06:30:26Z","modified":"2025-11-05T21:32:04Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:04:41.281435Z"}],"nvd":[{"id":"CVE-2025-6027","description":"The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.","status":"published","published":"2025-11-05T06:15:34.373Z","modified":"2026-10-19T13:10:00.11Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:42.142547Z"}]}}