Headline
CVE-2023-35039: WordPress Password Reset with Code for WordPress REST API plugin <= 0.0.15 - Privilege Escalation Due To Weak Pin Generation Vulnerability - Patchstack
Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15.
Solution
Update to fix
Update the WordPress Password Reset with Code for WordPress REST API plugin to the latest available version (at least 0.0.16).
Jonas Höbenreich discovered and reported this Broken Authentication vulnerability in WordPress Password Reset with Code for WordPress REST API Plugin. This can be abused by a malicious actor to perform action which normally should only be able to be executed by higher privileged users. These actions might allow the malicious actor to gain admin access to the website. This vulnerability has been fixed in version 0.0.16.
No other known vulnerabilities for this pluginReport
WordPress plugin developer?
Start a free security program for your WordPress plugins or request an audit.
Apply for MVDP
Security researcher?
Report to Patchstack Alliance bounty platform and earn monthly cash prizes.
Learn more