CVE-2025-3924

creationtimestamp| type| source ---|---|--- 2025-05-07 02:21:38+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15245 2025-05-07 04:26:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokkl3i7kg2h 2025-05-07 07:12:51+00:00| seen| https://t.me/cvedetector/24668...

CVE-2025-3924 PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via its publicly exposed reset-password endpoint. The plugin looks up the 'validemail' value based solely on a supplied username parameter, without verifying that the requester is associated...

CVE-2025-3924

CVE-2025-3924 concerns the WordPress plugin PeproDev Ultimate Profile Solutions (versions 1.9.1 through 7.5.2) and describes an endpoint exposed for password reset that returns the candidate email based only on a supplied username. The result is unauthenticated email enumeration, potentially expo...

WordPress PeproDev Ultimate Profile Solutions plugin 1.9.1-7.5.2 - Missing Authorization to Unauthenticated Email Enumeration

Missing Authorization to Unauthenticated Email Enumeration vulnerability discovered by kr0d in WordPress Plugin PeproDev Ultimate Profile Solutions versions 1.9.1-7.5.2...