WordPress Bulk Password Reset plugin <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset vulnerability

Authenticated Subscriber+ Arbitrary Password Reset vulnerability discovered by Afan, moonge in WordPress Plugin Bulk Password Reset versions = 1.3.3...

CVE-2026-14873

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-14873

The Bulk Password Reset plugin for WordPress is affected in all versions up to and including 1.3.3 by a privilege escalation vulnerability. The plugin fails to properly validate a user's identity before updating account details, allowing an authenticated attacker with subscriber-level access or a...

CVE-2026-14873 Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

EUVD-2026-75241

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-14873: Missing Authorization

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

PT-2026-89261

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

Force password reset for all users

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-30236. panel Administrators should have an easy way to force users to change passwords in bulk format in emergencies. Has this...