CVE-2024-13373 is a vulnerability in the Exertio Framework WordPress plugin caused by the fl_forgot_pass_new() function failing to properly verify a user's identity before allowing a password update. This allows unauthenticated attackers to reset passwords of arbitrary users, including administrators, leading to privilege escalation and account takeover. The issue affects all versions up to 1.3.1. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to reset passwords for any user, including administrators, resulting in full account takeover. This compromises confidentiality, integrity, and availability of the affected WordPress site. The vulnerability enables privilege escalation without requiring prior access or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the password reset functionality if possible and monitor for suspicious activity related to password changes. Avoid using affected versions of the Exertio Framework plugin.