Privilege Escalation Vulnerability in ForumWP Allows Attackers to Reset Admin Passwords

CVE-2024-8428

Summary

The ForumWP – Forum & Discussion Board Plugin for WordPress is susceptible to a privilege escalation issue through an insecure direct object reference. This vulnerability arises from a lack of proper validation on the 'user_id' key, which is controlled by users. Authenticated attackers with at least subscriber-level permissions are able to exploit this flaw to alter the email addresses associated with administrative accounts. This action can subsequently facilitate a password reset for admin users, potentially allowing unauthorized access to their accounts. It highlights a crucial need for stringent validation processes to safeguard sensitive user data and administrative credentials.

References