Arbitrary User Password Reset Vulnerability in Directorist Plugin for WordPress

CVE-2023-1888

What is CVE-2023-1888?

The Directorist plugin for WordPress contains a vulnerability that allows authenticated users with subscriber-level permissions and higher to reset any user's password. This flaw, stemming from insufficient validation checks in login.php, poses a significant security risk as it could enable attackers to gain unauthorized access and elevate their privileges, potentially taking control over the targeted accounts. Users of versions up to and including 7.5.4 are strongly advised to update their installations to mitigate this threat.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References