WordPress Plugin Vulnerabilities
WP User Control <= 1.5.3 - Unauthenticated password reset
Description
The WP User Control plugin for WordPress is vulnerable to unauthorized password resets due to the plugin using native password reset functionality. It is worth mentioning that the new password is only sent to the affected user's email, not being leaked to the attacker.
Affects Plugins
No known fix References
CVE
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Lana Codes
Verified
No
WPVDB ID
Timeline
Publicly Published
2023-09-12 (about 2 years ago)
Added
2023-09-20 (about 2 years ago)
Last Updated
2023-09-20 (about 2 years ago)
WPScan 