Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

WordPress fblog plugin vulnerable to account takeover via password reset

CVE-2025-43933 · published 1 year ago
Summary

The fblog plugin for WordPress has a security issue that allows attackers to take control of user accounts. This happens when the password reset feature is used without properly setting the SERVER_NAME configuration. To fix this, update the fblog plugin to the latest version, and ensure the SERVER_NAME is configured correctly.

Original advisory text
fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-472External Control of Assumed-Immutable Web Parameter
Timeline
Published7 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-43933 · NVD
Track software like this
Free during beta