Privilege Escalation Vulnerability in ForumWP Allows Attackers to Reset Admin Passwords

CVE-2024-8428

What is CVE-2024-8428?

The ForumWP – Forum & Discussion Board Plugin for WordPress is susceptible to a privilege escalation issue through an insecure direct object reference. This vulnerability arises from a lack of proper validation on the 'user_id' key, which is controlled by users. Authenticated attackers with at least subscriber-level permissions are able to exploit this flaw to alter the email addresses associated with administrative accounts. This action can subsequently facilitate a password reset for admin users, potentially allowing unauthorized access to their accounts. It highlights a crucial need for stringent validation processes to safeguard sensitive user data and administrative credentials.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References