CVE-2023-4915

Summary

CVE-2023-4915 is a vulnerability affecting the WP User Control plugin for WordPress. Versions up to and including 1.5.3 are susceptible to unauthorized password resets. The flaw lies in the insufficient validation on the plugin's password reset function. An attacker can manipulate the email parameter to trigger a password reset for any user. The new password is only sent to the user's email, preventing the attacker from directly gaining access to the account. This issue highlights the importance of regular plugin updates and strong validation measures for sensitive functionality.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.