CVE-2025-10645: WP Reset Plugin Information Disclosure Flaw

CVE-2025-10645 Overview

CVE-2025-10645 affects the WP Reset plugin for WordPress in all versions up to and including 2.05. The vulnerability resides in the WF_Licensing::log() method, which writes sensitive data to a log file when debugging is enabled. Debugging is enabled by default, which broadens the population of vulnerable installations. Unauthenticated attackers can retrieve the log to extract license keys and site data. The issue is categorized as Sensitive Information Exposure and is tracked under CWE-532: Insertion of Sensitive Information into Log File.

Critical Impact
Unauthenticated remote attackers can read license keys and site metadata from an exposed debug log file created by the WP Reset plugin.

Affected Products

WordPress plugin: WP Reset, versions up to and including 2.05
Sites where the plugin's default debug logging remains enabled
WordPress installations exposing the plugin log file via HTTP

Discovery Timeline

2025-10-07 - CVE-2025-10645 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10645

Vulnerability Analysis

The WP Reset plugin ships with a licensing helper class, WF_Licensing, that exposes a log() method used for diagnostic output. When the debug flag is active, the method writes license-related payloads, including keys and site identifiers, to a log file stored within the plugin directory. Because the log file is web-accessible and no authentication or access control is enforced on it, any unauthenticated client with the URL can retrieve its contents.

The vulnerability does not require user interaction, credentials, or elevated privileges. Exploitation reduces to issuing an HTTP GET request against the known log path once the plugin is installed and debugging remains at its default state.

Root Cause

The root cause is improper handling of sensitive information in log output, mapped to CWE-532. The log() method persists secrets such as license keys in plaintext, and the storage location lacks a directory-level access restriction (for example, an .htaccess deny rule or a randomized filename). Enabling debug logging by default multiplied the exposure across production installs.

Attack Vector

Attackers reach the vulnerability over the network by requesting the plugin's debug log directly from the WordPress site. The response returns the accumulated log entries containing license keys and site data. No authentication is required, and the impact is limited to confidentiality of the logged material. See the CleanTalk CVE-2025-10645 Analysis and the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-10645

Indicators of Compromise

Web server access logs showing anonymous GET requests to paths under /wp-content/plugins/wp-reset/ that target .log or .txt files
Repeated requests from a single source enumerating plugin log filenames
Unexpected outbound activity or license reuse alerts from the WP Reset vendor's licensing service

Detection Strategies

Inspect the WP Reset plugin directory for readable log files and review recent HTTP access to those paths
Correlate WordPress access logs with plugin file paths to identify unauthenticated reads of license log artifacts
Alert on responses returning wp-reset log content with HTTP 200 to non-administrative sessions

Monitoring Recommendations

Ingest WordPress access and error logs into a centralized log platform and build queries for plugin-directory file reads
Monitor file integrity for the WP Reset plugin folder to detect log file creation and growth
Track license key usage anomalies reported by the plugin vendor as a downstream signal of exposure

How to Mitigate CVE-2025-10645

Immediate Actions Required

Update the WP Reset plugin to a fixed version above 2.05 as published in the WordPress Changeset Update
Disable the plugin's debug logging option if patching cannot be performed immediately
Delete existing WP Reset log files and rotate any license keys that were written to them

Patch Information

The maintainer addressed the flaw in the WP Reset plugin through the commit tracked at the WordPress Changeset Update. Administrators should upgrade all sites running version 2.05 or earlier and verify that the patched release is active across multisite networks.

Workarounds

Turn off the WP Reset debug flag in the plugin settings to stop new sensitive data from being logged
Block direct HTTP access to the plugin directory using a web server rule such as Deny from all on wp-content/plugins/wp-reset/
Restrict access to .log files at the reverse proxy or WAF layer until the plugin is upgraded

bash

# Apache configuration to block direct access to WP Reset log files
<FilesMatch "\.(log|txt)$">
    Require all denied
</FilesMatch>