CVE-2025-5305

The Password Reset with Code for WordPress REST API plugin before version 0.0.17 uses insufficiently random algorithms to generate one-time passwords (OTPs) for password reset. This flaw makes it possible for an attacker to predict or brute-force the reset codes without cryptographic protection [1].

The vulnerability is exploitable remotely over the network without any authentication or user interaction, as the OTP codes are generated by the plugin's REST API endpoint. An attacker can simply attempt multiple codes until the correct one is guessed, bypassing the intended security of the password reset flow [1].

Successful exploitation leads to full account takeover, granting the attacker access to the targeted user's WordPress account. Given the plugin's role in password recovery, this can compromise the entire site if an administrator account is targeted [1].

The plugin developer addressed the issue in version 0.0.17 by switching to cryptographically secure random number generators for OTP creation. Users are strongly advised to update immediately [1].