PT-2026-5609 · WordPress · User Profile Builder

Drew Webber · Published 2026-02-02 · Updated 2026-02-07 · CVE-2025-15030

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions User Profile Builder WordPress plugin versions prior to 3.15.2

Description The User Profile Builder WordPress plugin does not have a secure password reset process. This allows unauthenticated requests to reset the password for any user, including administrators, by knowing their username. Successful exploitation grants access to user accounts.

Recommendations Update to User Profile Builder WordPress plugin version 3.15.2 or later.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-15030

Affected Products

User Profile Builder

References · 7

• 🔥 https://wpscan.com/vulnerability/344cb1b1-342e-44b2-ae4a-3bb31be56b22 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15030 · Security Note
• https://twitter.com/VulmonFeeds/status/2018238532267942342 · Twitter Post
• https://t.me/CVEtracker/43453 · Telegram Post
• https://twitter.com/cracbot/status/2020090210885988823 · Twitter Post
• https://twitter.com/CVEnew/status/2018227774696071171 · Twitter Post
• https://twitter.com/TheHackerWire/status/2018368586390384971 · Twitter Post