Unauthenticated Attackers Can Reset User Passwords via Weak Password Reset Mechanism in Build App Online Plugin

CVE-2023-7264

Summary

The Build App Online plugin for WordPress presents a significant security risk due to a flaw in its password reset mechanism. All versions up to and including 1.0.21 are affected, allowing unauthenticated attackers to reset passwords for arbitrary user accounts by exploiting a weak numerical reset code comprised of just four digits. This vulnerability highlights the need for stronger authentication protocols and underscores the importance of securing user accounts against unauthorized access.

References