Authorization Bypass Vulnerability in Lenxel WP WordPress Theme
CVE-2026-12586
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-12586?
The Lenxel WP WordPress theme prior to version 1.0.31 is susceptible to an authorization bypass vulnerability that allows unauthenticated users to reset passwords for any user, including administrative accounts. The vulnerability arises from the inadequate checks on the password-reset action, which only verifies a CSRF nonce, permitting attackers to exploit this weakness and gain unauthorized access to user accounts.
Affected Version(s)
Lenxel WP 0 <= 1.0.31
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.