PT-2025-38299 · WordPress · Password Reset With Code For Wordpress Rest Api

Tommaso Gregori · Published 2025-09-18 · Updated 2025-11-26 · CVE-2025-5305

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Password Reset with Code for WordPress REST API plugin versions prior to 0.0.17

Description The plugin does not employ cryptographically secure algorithms for generating One-Time Password (OTP) codes, which could allow for account takeovers.

Recommendations Update the Password Reset with Code for WordPress REST API plugin to version 0.0.17 or later.

Exploit

Fix

Related Identifiers

CVE-2025-5305

Affected Products

Password Reset With Code For Wordpress Rest Api

References · 6

• 🔥 https://wpscan.com/vulnerability/dcf5c003-91b0-4e7d-89f3-7459d8f01153 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5305 · Security Note
• https://twitter.com/CVEnew/status/1968561146354442587 · Twitter Post
• https://t.me/CVEtracker/32824 · Telegram Post
• https://twitter.com/dailycve/status/1993819598261510463 · Twitter Post
• https://t.me/cveNotify/135755 · Telegram Post