ThinkSNS+ CVE-2026-71625

Exploitation targets the ThinkSNS+ password-reset flow in ResetPasswordController.php and hinges on the verification/confirmation code not being properly invalidated after expiry - the attacker must be able to present a valid-but-expired (or reused) verification code for the target account to complete the reset. Limiting factors: the attacker needs to reach the reset endpoint over the network (feasible on internet-facing deployments) and needs a usable code value for the victim; if codes are high-entropy and only the expiry check is broken, the attacker still requires access to a previously issued code (reuse/interception) rather than pure guessing. No authentication is required (PR:N) and no user interaction (UI:N), so on a default internet-exposed ThinkSNS+ v2.4 instance the attack is remotely reachable, bounded chiefly by the attacker's ability to obtain/guess the reset code.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remotely reachable, low-complexity, unauthenticated flaw, which is directionally consistent with an unauthenticated password-reset abuse. However, the signals diverge on real-world urgency: EPSS is only 0.21% (11th percentile), there is no KEV listing, and no exploit code is confirmed - indicating low observed/predicted exploitation despite the high CVSS. The A:H (availability) rating is questionable for an account-takeover primitive; the realistic impact is confidentiality and integrity of the victim account, with availability limited to locking out the specific user, so the true footprint is likely narrower than 9.8 implies. Exploitation also practically depends on the attacker being able to trigger and present a (possibly guessable or intercepted) verification code for a target, which the description does not fully quantify. Overall: a genuine unauthenticated ATO weakness worth patching, but a niche product plus low EPSS make it a moderate rather than emergency priority.

An attacker initiates a password reset for a victim's ThinkSNS+ account and obtains a verification code that has already expired (via reuse of a prior code, interception, or brute force of a weak/non-expiring code). Because ResetPasswordController.php still accepts the stale code, the attacker submits it with a new password and takes over the account remotely without authentication. If the targeted account holds administrative privileges, this yields elevated platform control. A public technical writeup documents the flow, but no packaged exploit code is confirmed.