teydeastudio vulnerabilities and threats

The WP Password Policy plugin for WordPress contains a privilege escalation vulnerability in all versions up to and including 3.7.1. This flaw arises from missing authorization checks and nonce verification in the get_user() function of the Module_Password_Hint class, allowing authenticated users with subscriber-level access or higher to escalate their privileges to Administrator by submitting a crafted POST request to the password-reset form endpoint. The vulnerability is triggered via the password_hint filter during password-reset form rendering and requires only a valid password-reset cookie.