WHIZZ WordPress plugin password reset flaw allows account takeover
Anyone can change admin passwords through the WHIZZ WordPress plugin!
Summary
The WHIZZ WordPress plugin does not validate the password-reset key, so an unauthenticated attacker can set a password for any user. Administrator accounts are included, so whole accounts can be taken over.
What to do
Versions 1.1.8 and older are affected, so check that the plugin runs a newer version and read the vendor's advisory. WPScan lists no known fix.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
Times
First published
First seen