PT-2026-5248 · WordPress · Custom Login Page Customizer

Drew Webber · Published 2026-01-29 · Updated 2026-01-31 · CVE-2025-14975

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Custom Login Page Customizer WordPress plugin versions prior to 2.5.4

Description The Custom Login Page Customizer WordPress plugin does not have a proper password reset process. This allows unauthenticated requests to reset the password of any user, given their username, potentially granting access to their account. Approximately 90,000 installations may be affected. The issue involves automated discovery and user enumeration, controlled reset-key injection, session-aware flow handling, privilege verification, modular exploitation, and concurrent processing.

Recommendations Update the Custom Login Page Customizer WordPress plugin to version 2.5.4 or later.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-14975

Affected Products

Custom Login Page Customizer

References · 7

• 🔥 https://wpscan.com/vulnerability/a1403186-51aa-4eae-a3fe-0c559570eb93 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14975 · Security Note
• https://twitter.com/TheHackerWire/status/2016934572831969547 · Twitter Post
• https://t.me/CVEtracker/43217 · Telegram Post
• https://twitter.com/Nxploited/status/2017400285648371867 · Twitter Post
• https://t.me/cveNotify/150240 · Telegram Post
• https://twitter.com/CVEnew/status/2016760525221228673 · Twitter Post