EUVD-2026-38679
GHSA-w6gx-c4x9-qjp2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Single unauthenticated HTTP request over the network reliably resets any admin password, yielding full C/I/A impact with no user interaction.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. This is due to the pravel_change_password() AJAX handler - registered via wp_ajax_nopriv_pravel_change_password and therefore accessible to unauthenticated users - performing no nonce verification, no capability check, and only a loose equality check between an attacker-supplied reset_activation_code POST parameter and the target user's forgot_email user meta value; when a user has never initiated a password reset, get_user_meta() returns an empty string that trivially satisfies this check against an omitted or empty attacker-supplied code. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by sending a crafted POST request to admin-ajax.php with action=pravel_change_password, reset_user_id set to the target account's user ID, and new_password_custom set to an attacker-chosen password. Successful exploitation allows the attacker to authenticate with the newly set password and fully take over the targeted account, achieving administrator-level privilege escalation on the affected site.
Articles & Coverage 4
AnalysisAI
Unauthenticated account takeover in the SignUp & SignIn WordPress plugin (versions ≤ 1.0.0) allows remote attackers to reset any user's password - including administrators - via the unauthenticated pravel_change_password AJAX action. No public exploit identified at time of analysis, but the trivially-bypassable empty-string comparison and AV:N/AC:L/PR:N/UI:N vector make exploitation essentially one HTTP request. The plugin's small footprint likely keeps EPSS low, but any site running it is fully exposed.
Technical ContextAI
The flaw resides in the Pravel SignUp & SignIn WordPress plugin's pravel_change_password() handler in lib/function.php, registered via wp_ajax_nopriv_pravel_change_password - a WordPress hook that exposes an AJAX endpoint to unauthenticated visitors at /wp-admin/admin-ajax.php. The handler omits both nonce verification (CSRF protection) and capability checks, and authenticates the password reset by comparing an attacker-supplied reset_activation_code POST value against the target user's forgot_email user meta using a loose == equality. The CPE identifies the affected component as cpe:2.3:a:pravel:signup_&_signin:*. The root cause maps to CWE-640 (Weak Password Recovery Mechanism for Forgotten Password): because get_user_meta() returns an empty string when no reset has been initiated, PHP's loose comparison treats an omitted/empty attacker code as equal, collapsing the recovery secret to a null value for every account that has never used the reset flow.
RemediationAI
No vendor-released patch identified at time of analysis - 1.0.0 is the latest published version and remains vulnerable. The most reliable mitigation is to deactivate and uninstall the SignUp & SignIn plugin immediately, since the entire password-reset flow it provides is unsafe; this will remove any custom registration/login forms the site relied on, so prepare a fallback using WordPress core authentication or a maintained alternative plugin before removal. As a short-term compensating control, block requests to /wp-admin/admin-ajax.php containing action=pravel_change_password at the WAF, reverse proxy, or via a mu-plugin that unhooks the action with remove_action('wp_ajax_nopriv_pravel_change_password', ...); the side effect is that the plugin's password-reset feature stops working entirely, which is desirable here. Monitor the Wordfence advisory (wordfence.com/threat-intel/vulnerabilities/id/c0a617fc-da3d-4828-b027-44093dd11769) and the plugin's WordPress.org page for a fixed release, and audit all user accounts for unexpected password changes or new administrator sessions, since any prior exploitation would be silent.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today