WordPress Plugin Vulnerabilities
Custom Login Page Customizer < 2.5.4 - Unauthenticated Arbitrary Password Reset
Description
The plugin does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
Proof of Concept
Affects Plugins
Fixed in 2.5.4 References
CVE
Classification
Type
PRIVESC
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Drew Webber (mcdruid)
Submitter
Drew Webber (mcdruid)
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-01-08 (about 21 days ago)
Added
2026-01-08 (about 20 days ago)
Last Updated
2026-01-08 (about 20 days ago)
WPScan 