The Change pwd page module for Drupal provides a form for users to change their own password by verifying the current password. However, it does not sufficiently verify the current password in some cases. This vulnerability requires the attacker to have access to the victim's authenticated session, such as through an unattended browser or stolen session cookie, allowing temporary session access to be escalated into a persistent account takeover. A fix is available in version 2.0.3.