A Cross‑Site Request Forgery (CSRF) flaw exists in the WordPress Emergency Password Reset plugin that allows an attacker to craft a request which the victim’s browser will submit with the victim’s credentials. This can lead to unintended password resets for logged‑in users. The weakness is specified by CWE‑352 and represents a lack of proper request validation, allowing state‑changing actions without user consent.

The affected product is the andy_moyle Emergency Password Reset plugin for WordPress, versions n/a through 9.3. Any WordPress installation using this plugin version is potentially vulnerable. No other versions are included as a consequence of the plugin’s release timeline.

The CVSS score of 4.3 indicates low to moderate severity. The EPSS score is less than 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, which further indicates limited known exploitation. Attackers would need to lure a legitimate user or administrator to a page that triggers the plugin’s reset operation, making the attack vector web‑based and dependent on user interaction. Successful exploitation could allow an attacker to reset user passwords and potentially gain unauthorized access.