PT-2025-19912 · WordPress · Peprodev Ultimate Profile Solutions

Kenneth Dunn · Published 2025-05-07 · Updated 2025-05-07 · CVE-2025-3924

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PeproDev Ultimate Profile Solutions plugin for WordPress (affected versions not specified)

Description The issue allows unauthorized access to data via a publicly exposed reset-password endpoint. The plugin looks up the valid email value based solely on a supplied username parameter, without verifying that the requester is associated with that user account. This enables unauthenticated attackers to enumerate email addresses for any user, including administrators.

Recommendations For the PeproDev Ultimate Profile Solutions plugin, consider disabling the reset-password endpoint until a patch is available. Restrict access to the endpoint to minimize the risk of exploitation. Avoid using the username parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-3924

Affected Products

Peprodev Ultimate Profile Solutions

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3924 · Security Note
• https://t.me/cvedetector/24668 · Telegram Post
• https://wordpress.org/plugins/peprodev-ups/#developers · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7bb36c0f-68b3-492e-9f08-fe6228b0363f?source=cve · Note
• https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L2810 · Note
• https://t.me/cvetracker/23229 · Telegram Post
• https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L1483 · Note
• https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L2659 · Note