PT-2026-1413 · WordPress · As Password Field In Default Registration Form
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
AS Password Field In Default Registration Form plugin for WordPress versions prior to 2.0.1
Description
The plugin does not properly validate a user’s identity before allowing password updates. This allows unauthenticated attackers to change passwords for any user, including administrators, leading to account takeover. The issue involves a privilege escalation, enabling attackers to gain unauthorized access to accounts.
Recommendations
Update to version 2.0.1 or later.
Correção
LPE
IDOR
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
As Password Field In Default Registration Form