CVE-2025-57942

MediumCVSS 4.3

Published: 22/09/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The Emergency Password Reset plugin (emergency-password-reset) is vulnerable to Cross-Site Request Forgery. This issue affects versions from n/a through <= 9.3.

Risk Assessment

An attacker can trick an administrator into performing an unintended action, potentially leading to unauthorized configuration changes or password resets.

Recommendation

Update the Emergency Password Reset plugin to a version later than 9.3 or disable it if no update is available.

Other vulnerabilities in Emergency Password Reset

CVE-2024-35648Medium
CSRF vulnerability in Andy Moyle's Emergency Password Reset allows Cross-Site Request Forgery. This issue affects versions from n/a through 8.0.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Emergency Password Reset emergency-password-reset allows Cross Site Request Forgery.This issue affects Emergency Password Reset: from n/a through <= 9.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS