Threats tagged 'ghsa-595x-7jqx-w5jq'

The WHIZZ WordPress plugin up to version 1.1.8 has a vulnerability where it does not properly validate the password-reset key before updating a user's password. Instead, it relies solely on a nonce that is accessible to unauthenticated visitors. This flaw allows attackers to set arbitrary passwords for any user account, including administrators, enabling full account takeover.