Privilege Escalation Vulnerability in Exertio Framework by WordPress

CVE-2024-13373

What is CVE-2024-13373?

The Exertio Framework plugin for WordPress is susceptible to a vulnerability that allows an unauthenticated attacker to escalate privileges by exploiting the fl_forgot_pass_new() function. This flaw arises from inadequate validation of a user's identity during password updates, enabling attackers to reset passwords for any user account, including that of administrators. Consequently, this vulnerability can be leveraged to gain unauthorized access to sensitive accounts, posing a significant threat to the security of websites utilizing this plugin.

References