CVE-2025-14975
Published: 29 January 2026
Summary
CVE-2025-14975 is a high-severity Improper Privilege Management (CWE-269) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-14975 is a high-severity vulnerability in the Custom Login Page Customizer WordPress plugin, affecting versions prior to 2.5.4. It arises from an improper password reset process (CWE-269), which fails to enforce adequate authentication checks. Published on 2026-01-29, the issue carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting significant confidentiality, integrity, and availability impacts.
Unauthenticated attackers can exploit this vulnerability remotely if they know a target user's username, such as an administrator's. By sending a few unauthenticated requests, they can reset the password and gain full access to the account, potentially allowing site takeover, data exfiltration, or further compromise of the WordPress installation.
The WPScan advisory at https://wpscan.com/vulnerability/a1403186-51aa-4eae-a3fe-0c559570eb93/ details the issue, with mitigation achieved by updating to version 2.5.4 or later, which addresses the flawed reset mechanism.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206542
Vulnerability details
The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain…
more
access to their account
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin enables remote unauthenticated password reset (T1190) leading to valid account takeover (T1078).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
IA-5 requires verifying user identity prior to issuing new authenticators like passwords during resets, directly preventing unauthorized password changes via unauthenticated requests.
SI-2 mandates timely identification, reporting, and correction of flaws such as the plugin's improper password reset mechanism through patching to version 2.5.4 or later.
AC-2 enforces account management processes to monitor, review, and disable compromised accounts resulting from unauthorized password resets.