Emergency password reset
Emergency password reset has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (100%).
Every one of the 2 issues recorded for Emergency password reset has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Emergency password reset is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-57942Emergency Password Reset <= 9.3 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
Emergency password reset
Author
andy_moyle
This plugin does 3 things 1) It will check you don’t have a username called “admin” which is asking to be hacked 2) It will allow you to reset all passwords, with an password reset link sent to all users to warn them. Following a couple of reviews from v7.0 the plugin will allow you to set the email from address, name, subject and message 3) You can also change the SALTS which forces a logout of all users.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C