CVE-2024-13375 is a critical privilege escalation vulnerability in the spoonthemes Adifier System WordPress plugin (versions up to 3.1.7). The vulnerability arises from the adifier_recover() function failing to properly validate user identity before allowing password changes. This flaw permits unauthenticated attackers to reset passwords of arbitrary users, including administrators, thereby gaining unauthorized access to their accounts. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to take over any user account by changing its password, including administrator accounts. This leads to full compromise of the affected WordPress site, with complete control over site content, configuration, and potentially other integrated systems. The vulnerability poses a critical risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin functionality, disable or remove the Adifier System plugin if possible, and monitor for suspicious activity. Avoid using affected versions in production environments.