CVE-2026-12417

Name of the Vulnerable Software and Affected Versions SignUp & SignIn plugin for WordPress versions prior to 1.0.1

Description The SignUp & SignIn plugin for WordPress contains an authentication bypass that allows unauthenticated attackers to take over any account, including administrator accounts. The issue exists in the pravel change password() AJAX handler, which is registered via wp ajax nopriv pravel change password and accessible without authentication. The handler fails to perform nonce verification or capability checks and uses a loose equality check between the reset activation code POST parameter and the forgot email user meta value. If a user has not initiated a password reset, the system returns an empty string, which can be trivially matched by an attacker providing an empty or omitted code. Attackers can exploit this by sending a crafted POST request to the 'admin-ajax.php' endpoint with the action parameter set to pravel change password, the reset user id set to the target user ID, and new password custom set to a password of their choice.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.