Privilege Escalation Vulnerability in WP-Recall Plugin Could Lead to Account Takeover

CVE-2024-8292

Summary

The WP-Recall plugin for WordPress possesses a vulnerability that allows unauthenticated attackers to exploit a flaw in user identity verification during the creation of a new order. This issue affects all versions up to and including 16.26.8 and is contingent upon the commerce addon being enabled. Attackers have the potential to input any email address into the user_email field and subsequently update the password associated with that account. This security loophole poses a significant risk as it effectively grants unauthorized access to user accounts without the need for prior authentication.

References