CVE-2025-5305: Unknown Password Reset With Code For WordPress Rest API

Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers.

Affected products

• Unknown Password Reset With Code For WordPress Rest API: before 0.0.17 (fixed in 0.0.17)

Published 2025-09-18. Last modified 2026-06-17.