PT-2025-45083 · WordPress · Ace User Management

Aschoiloa1890 · Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-6027

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ace User Management WordPress plugin versions through 2.0.3

Description The Ace User Management WordPress plugin does not properly validate that a password reset token is associated with the requesting user. This allows authenticated users, even those with subscriber privileges, to reset the passwords of any account, including administrator accounts.

Recommendations Update Ace User Management WordPress plugin to a version later than 2.0.3.

Exploit

Fix

Related Identifiers

CVE-2025-6027

Affected Products

Ace User Management

References · 3

• 🔥 https://wpscan.com/vulnerability/06fb8088-10e3-424e-a3ac-4673bac49467 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6027 · Security Note
• https://t.me/CVEtracker/36592 · Telegram Post