Filtered by vendor Wpusermanager Subscriptions
Filtered by product Wp User Manager Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-24655 1 Wpusermanager 1 Wp User Manager 2022-07-18 7.5 High
The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only their ID, and gain access to their account.