Build App Online <= 1.0.19 - Unauthenticated Account Takeover via Weak Password Reset Mechanism

2024-01-0500:00:00

wpscan.com

plugin vulnerability unauthenticated attackers

AI Score

7.4

Confidence

High

EPSS

Percentile

9.0%

JSON

Description The plugin is vulnerable to account takeover due to a weak password reset mechanism, allowing unauthenticated attackers to reset the password of arbitrary users by guessing an 8-digit numeric reset code.

References

patchstack.com/database/vulnerability/build-app-online/wordpress-build-app-online-plugin-1-0-19-unauthenticated-account-takeover-vulnerability