CVE-2025-5305

critical · 9.8

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers.

9.8

CVSS

0.2%

EPSS (exploit prob.)

15th

EPSS percentile

2025-09-18

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/dcf5c003-91b0-4e7d-89f3-7459d8f01153/
https://wpscan.com/vulnerability/dcf5c003-91b0-4e7d-89f3-7459d8f01153/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-5305