The Ace User Management plugin for WordPress version 2.0.3 and earlier fails to verify that a password‑reset token is linked to the user making the request, allowing any authenticated user, such as a subscriber, to reset the passwords of arbitrary accounts, including administrators. This flaw enables an attacker to gain full control of privileged accounts by simply entering a new password for the target. The vulnerability corresponds to a missing authorization weakness (CWE‑285) and is assigned a CVSS score of 6.3, indicating moderate severity.

WordPress sites running the Ace User Management plugin with a version of 2.0.3 or earlier. The plugin is the sole product affected; no other WordPress components are implicated.

The CVSS score of 6.3 reflects moderate risk. The EPSS score of less than 1% indicates that, at present, the probability of exploitation is low, and the flaw is not listed in the CISA KEV catalog. An attacker must be authenticated and able to submit the password‑reset form; no special code injection or remote code execution is required. Once an authenticated session exists, the exploit can be performed by instructing the site to reset any user’s password, making this a relatively straightforward privilege escalation vector.