CVE-2025-10645WP Reset <= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log

Descripción

The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method when debugging is enabled (default). This makes it possible for unauthenticated attackers to extract sensitive license key and site data.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://www.wordfence.com/threat-intel/vulnerabilities/id/86741f4a-8700-45dd-8998-b3f0387c27ed?source=cve
• https://plugins.trac.wordpress.org/changeset/3364169/
• https://research.cleantalk.org/cve-2025-10645/