CyberRota Analysis
AI-GeneratedThe BricksForge WordPress plugin prior to version 3.1.8.8 is vulnerable due to a lack of identity verification during password change requests, enabling unauthenticated attackers to reset passwords for any user, including administrators. This vulnerability poses a significant risk of account takeover, particularly for sites utilizing the plugin's password reset feature in its default configuration. WordPress site administrators using the BricksForge plugin should prioritize updating to the latest version to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.