Threats tagged 'ghsa-v22x-qm55-p7pm'

The Ace User Management WordPress plugin versions up to 2.0.3 contain a vulnerability where password reset tokens are not properly validated against the user who requested them. This flaw allows any authenticated user, including low-privileged roles like subscribers, to reset passwords of arbitrary accounts, potentially including administrators.