WP Manifestindependent plugin directory
manifest / security / builtmighty-password-reset

🔑 Built Mighty Password Reset WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

by Built Mighty · github.com/builtmighty/builtmighty-password-reset · website

★ 0stars
1.4.0latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/builtmighty/builtmighty-password-reset/archive/refs/heads/main.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
From the readme github.com/builtmighty/builtmighty-password-reset ↗
🔑 Built Mighty Password Reset About Our password reset plugin gives site administrators better tools around requiring users to reset their passwords. It includes both a timed password reset and a bulk password reset. The timed reset requires users to update their password every x amount of days. The bulk reset, however, requires users of a certain user level to reset their password, via a link sent to their email, on login and does not allow them to login until they've done so. Installation To install, add the plugin like any other WordPress plugin. Then go to Settings Password Reset to configure. Developers The plugin comes with several actions and filters for you to modify specific pieces of the plugin. Actions These are the following actions that are available. All of these actions include the user ID. builtpassbeforenotice An action that runs before the password reset notice page content. Shown to bulk reset users. builtpassresetnotice An action that runs within the content of the password reset notice page. Shown to bulk reset users. builtpassafternotice An action that runs after the password reset notice page content. Shown to bulk reset users. builtpassbeforeexterna

Releases

6 releases.

Tag
Published
1.4.0 latest
Mar 26, 2025 1 year ago
1.3.0
Mar 26, 2025 1 year ago
1.2.1
Mar 7, 2025 1 year ago
1.2.0
Jan 27, 2025 1 year ago
1.1.0
Oct 22, 2024 2 years ago
1.0.0
Apr 2, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

🔑 Built Mighty Password Reset 1.4.0 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.4.0
Findings
2
Worst severity
high
Content hash
a2a05a721f9eea7f12c1d761…

Findings

  • high Reflected XSS via $_GET['user'] on public reset pages

    xss_reflected

    Public templates reset-external.php and reset-expired.php echo $_GET['user'] into HTML attribute values without esc_attr. template_include serves these for unauthenticated visitors when password-reset-required / password-reset-expired query args are set. Attacker crafts URL with XSS payload in user param; reflected into hidden input value.

    public/views/reset-external.php:71-71

  • high Reflected XSS via $_GET['user'] on expired-reset template

    xss_reflected

    Same unescaped echo on reset-expired.php public template.

    public/views/reset-expired.php:48-48

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →