What the vulnerability does
01Description
The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (in the WP User Control Widget). The function changes the user's password after providing the email. The new password is only sent to the user's email, so the attacker does not have access to the new password.
Explanation of Vulnerability in Simple Terms
02Summary
WP User Control versions up to 1.5.3 contain an integrity vulnerability that allows unauthenticated attackers to modify data via the network. The vulnerability requires no user interaction and can be exploited remotely. Site administrators should update to a version newer than 1.5.3 to remediate the issue.
What an attacker can do
03Attacker Capabilities
Modify site data without authentication.
Potential impact on your site
04Site Impact
Attackers can alter site content or settings without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
September 13, 2023
CVE published
April 8, 2026
Record updated
