CVE-2025-6027: Unknown Ace User Management

Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.

Affected products

• Unknown Ace User Management: up to and including 2.0.3

Published 2025-11-05. Last modified 2026-06-17.