PT-2023-31069 · WordPress · Wp User Control

István Márton + 1 · Published 2023-09-12 · Updated 2023-09-15 · CVE-2023-4915

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP User Control plugin for WordPress versions up to, and including 1.5.3

Description The issue arises from the plugin's use of native password reset functionality with insufficient validation on the password reset function in the WP User Control Widget. This function changes a user's password after providing their email, and the new password is sent to the user's email. As a result, an attacker can initiate unauthorized password resets but will not have access to the new password.

Recommendations For versions up to, and including 1.5.3, update to a version later than 1.5.3 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2023-4915

Affected Products

Wp User Control

References · 6

• https://osv.dev/vulnerability/CVE-2023-4915 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4915 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f4ca1736-7b99-49db-9367-586dbc14df41?source=cve · Note
• https://twitter.com/CVEnew/status/1701821396031324316 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1701939104399708571 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-user-control/tags/1.5.3/inc/WPUserControlWidget.php#L893 · Note