Unauthenticated Attackers Can Change Admin Passwords via Plugin Vulnerability

CVE-2024-9862

Summary

The MiniOrange OTP Verification with Firebase plugin for WordPress contains a vulnerability that allows for arbitrary user password changes. In versions up to and including 3.6.0, the plugin fails to adequately restrict user access to system resources, permitting unauthorized users to bypass essential authorization checks. This issue arises from the absence of a verification step for the user's current password, opening the door for unauthenticated attackers to alter the passwords of existing accounts, including those of administrators, thereby posing significant risks to system security and user data integrity.

References