CVE-2021-24655 — WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise
The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated use…
Published: 2022-07-17 · CVSS: Unscored
The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only their ID, and gain access to their account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7