CVE-2026-14873

The Bulk Password Reset plugin for WordPress fails to properly verify the identity of the user whose details are being changed, allowing a logged-in attacker with subscriber-level access or higher to update the email address of arbitrary users, including administrators, and then trigger a password reset to take over the account. The attack is triggered by an authenticated low-privileged user sending a request that modifies another user's email (or password) without an adequate authorization check (CWE-862). By redirecting an administrator's email to an attacker-controlled address and resetting the password, the attacker gains full administrator access and complete control of the site. Any WordPress site running the plugin in versions up to and including 1.3.3 is affected, particularly sites that allow user registration or otherwise have subscriber-level accounts. There is currently no known exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.

What to do: Update the Bulk Password Reset plugin to a version newer than 1.3.3 as soon as a patched release is available. Until then, restrict or disable new user registrations and consider deactivating the plugin on sites that don't need bulk password resets. Audit administrator accounts for unexpected email address or password changes, and review recently created or modified subscriber-level accounts for signs of exploitation.