What’s Vulnerable › Vulnerabilities

CVE-2025-10645: WP Reset <= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-07 · updated 2026-10-08
• Weakness: CWE-532

Description

The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method when debugging is enabled (default). This makes it possible for unauthenticated attackers to extract sensitive license key and site data.

Affected products

• webfactory WP Reset: through 2.05

References

• https://plugins.trac.wordpress.org/changeset/3364169/
• https://research.cleantalk.org/cve-2025-10645/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/86741f4a-8700-45dd-8998-b3f0387c27ed?source=cve

Get alerted when CVE-2025-10645 or the next vulnerability affects your stack