plugin

Bulk Password Reset Vulnerabilities

1 known security issue reported for the Bulk Password Reset WordPress plugin. Most recent disclosed Sep 9, 2026.

1 high

Running Bulk Password Reset on your site? Check whether your installed version is affected.

Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset

high

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a...

CVSS:: 8
Affected:: up to 1.3.3
Fix:: No patched version reported
Disclosed:: Sep 9, 2026

CVE-2026-14873 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database