Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by rubenw
CVE-2026-14873 (GCVE-0-2026-14873)
Vulnerability from nvd – Published: 2026-09-10 03:40 – Updated: 2026-09-10 03:40
VLAI
EPSS
VEX
Title
Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
Summary
The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rubenw | Bulk Password Reset |
Affected:
0 , ≤ 1.3.3
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Bulk Password Reset",
"vendor": "rubenw",
"versions": [
{
"lessThanOrEqual": "1.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Afan"
},
{
"lang": "en",
"type": "finder",
"value": "moonge"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user\u0027s identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user\u0027s email addresses, including administrators, and leverage that to reset the user\u0027s password and gain access to their account."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:40:42.058Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93237020-435f-41a6-bcca-fe7b605723ae?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L679"
},
{
"url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L659"
},
{
"url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L594"
},
{
"url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L44"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-09T14:49:19.000Z",
"value": "Disclosed"
}
],
"title": "Bulk Password Reset \u003c= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14873",
"datePublished": "2026-09-10T03:40:42.058Z",
"dateReserved": "2026-07-06T14:18:17.520Z",
"dateUpdated": "2026-09-10T03:40:42.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14873 (GCVE-0-2026-14873)
Vulnerability from cvelistv5 – Published: 2026-09-10 03:40 – Updated: 2026-09-10 03:40
VLAI
EPSS
VEX
Title
Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
Summary
The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rubenw | Bulk Password Reset |
Affected:
0 , ≤ 1.3.3
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Bulk Password Reset",
"vendor": "rubenw",
"versions": [
{
"lessThanOrEqual": "1.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Afan"
},
{
"lang": "en",
"type": "finder",
"value": "moonge"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user\u0027s identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user\u0027s email addresses, including administrators, and leverage that to reset the user\u0027s password and gain access to their account."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:40:42.058Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93237020-435f-41a6-bcca-fe7b605723ae?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L679"
},
{
"url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L659"
},
{
"url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L594"
},
{
"url": "https://plugins.trac.wordpress.org/browser/bulk-password-reset/tags/1.3.3/bulk_password_reset.php#L44"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-09T14:49:19.000Z",
"value": "Disclosed"
}
],
"title": "Bulk Password Reset \u003c= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14873",
"datePublished": "2026-09-10T03:40:42.058Z",
"dateReserved": "2026-07-06T14:18:17.520Z",
"dateUpdated": "2026-09-10T03:40:42.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}