CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15.
Explanation of Vulnerability in Simple Terms
The Password Reset with Code plugin for WordPress REST API versions up to 0.0.15 contains a flaw that allows unauthenticated attackers to run arbitrary code on the site. The vulnerability stems from improper rate limiting or validation of password reset tokens, enabling attackers to bypass authentication and execute PHP code with full site privileges.
What an attacker can do
Run arbitrary PHP code on the site and take complete control without needing a valid account.
Potential impact on your site
Complete site compromise: attackers can steal data, modify content, install backdoors, or take the site offline.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
