CVE-2024-8292 is an authorization bypass vulnerability in the WP-Recall – Registration, Profile, Commerce & More WordPress plugin. The flaw arises from improper verification of user identity during new order creation when the commerce addon is enabled. This allows unauthenticated attackers to specify any email address in the user_email field and reset the password for that user, effectively enabling privilege escalation or account takeover. The vulnerability affects all plugin versions up to 16.26.8. No vendor advisory or patch information is currently provided, and there are no known exploits in the wild as of the published date.

Successful exploitation allows unauthenticated attackers to reset passwords of arbitrary users, leading to full account takeover and potential privilege escalation. This compromises confidentiality, integrity, and availability of user accounts and possibly the entire WordPress site. The CVSS score of 9.8 reflects critical impact across confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the commerce addon or the WP-Recall plugin if possible to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.