CVE-2023-3222: Password Recovery Project Password Recovery

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.

Affected products

• Password Recovery Project Password Recovery: version 1.2 only

Published 2023-09-04. Last modified 2026-06-17.