Threats tagged 'ghsa-5hm3-fq9v-vwj3'

The login-social WordPress plugin versions up to 1.0.4 contains an improper authentication vulnerability. It fails to validate password-reset requests against a reset key or verify the requester's identity. This flaw allows unauthenticated attackers to reset any user's password or log in as any existing user, including administrators, potentially leading to full site takeover.