Vulnerability · Published Nov 5, 2025 · Assigned by WPScan
CVE-2025-6027Ace User Management <= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest
Medium 6.3
In plain English
A medium-severity security flaw in Ace User Management from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 91.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Ace User Management | 0 – through 2.0.3 |
References
- https://wpscan.com/vulnerability/06fb8088-10e3-424e-a3ac-4673bac49467/ exploit, vdb-entry, technical-description