placester WordPress plugin lets unauthenticated users take over accounts
Anyone can take over admin accounts on this WordPress property-site plugin without logging in!
Summary
The placester WordPress plugin has no permission check on an action that updates account details, so an unauthenticated attacker can overwrite any user's email address, including an administrator's, and take the account through the password-reset flow. Versions through 1.4.3 are affected.
What to do
No fixed version is known. Check that you run a version newer than 1.4.3, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen