CVE-2025-10645

MEDIUM 5.3 CVSS 3.1

Published: October 7, 2025
Last modified: October 8, 2026
NVD status: Deferred
Reported by: security@wordfence.com
Weakness: CWE-532
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method when debugging is enabled (default). This makes it possible for unauthenticated attackers to extract sensitive license key and site data.

Affected WordPress components

WP Reset Plugin · wp-reset

Confirmed match Active

Up to and including 2.05
View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

webfactory WP Reset — Up to and including 2.05

References

plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3364169/
research.cleantalk.org https://research.cleantalk.org/cve-2025-10645/
www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/86741f4a-8700-45dd-8998-b3f0387c27ed?source=cve
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected WordPress components

Affected products and versions

References