CVE-2025-15030

The User Profile Builder WordPress plugin, in versions before 3.15.2 , contains a critical vulnerability due to an improper password reset process . The root cause is that the action2=recover_password2 flow fails to properly validate reset keys or enforce token expiration. An unauthenticated atta...