PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.
Summary
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via its publicly exposed reset-password endpoint. The plugin looks up the 'valid_email' value based solely on a supplied username parameter, without verifying that the requester is associated with that user account. This allows unauthenticated attackers to enumerate email addresses for any user, including administrators.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-3924
- 2026-10-03 Alias added: GHSA-gx79-p29g-9rqw
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb36c0f-68b3-492e-9f08-fe6228b0363f?source=cve
- https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L1483
- https://wordpress.org/plugins/peprodev-ups/#developers
- https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L2659
- https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L2810
More peprodev vulnerabilities
- TI-2025-03394 PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover CVSS 3.1CRITICAL 9.8
- TI-2025-03467 Improper authorization in PeproDev Ultimate Profile Solutions CVSS 3.1HIGH 8.2
- TI-2024-17033 WordPress PeproDev Ultimate Invoice plugin <= 1.9.7 - Sensitive Data Exposure vulnerability CVSS 3.1HIGH 7.5
- TI-2024-12758 PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure CVSS 3.1MEDIUM 5.3
- TI-2023-22256 WordPress PeproDev CF7 Database Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
- TI-2026-70134 Stored cross-site scripting in PeproDev Ultimate Profile Solutions CVSS 3.1MEDIUM 6.4
Sources
- CVE-2025-3924 · CVE Program
- CVE-2025-3924 · NVD
- FIRST EPSS
- GHSA-gx79-p29g-9rqw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences