WCFM Membership < 2.11.0 - Unauthenticated Arbitrary Password Update via IDOR

The plugin allows unauthenticated attackers to update the password of arbitrary account via an IDOR attack, which could allow them to gain access to high privilege ones such as administrator