Lenxel Wp
Monthly
Account takeover via unauthenticated password reset in the Lenxel WP WordPress theme (all versions through 1.0.31) allows any unauthenticated remote attacker to seize control of any WordPress account, including site administrators, by submitting a crafted reset request without owning or being authorized for the target account. The theme's reset action validates only a WordPress CSRF nonce - obtainable by any visitor loading the reset page - while performing no ownership or authorization check against the account being reset. No confirmed active exploitation (not in CISA KEV), though a public POC exists via WPScan and SSVC rates the technical impact as total; EPSS remains very low at 0.12% (2nd percentile), consistent with the niche theme footprint.
Account takeover via unauthenticated password reset in the Lenxel WP WordPress theme (all versions through 1.0.31) allows any unauthenticated remote attacker to seize control of any WordPress account, including site administrators, by submitting a crafted reset request without owning or being authorized for the target account. The theme's reset action validates only a WordPress CSRF nonce - obtainable by any visitor loading the reset page - while performing no ownership or authorization check against the account being reset. No confirmed active exploitation (not in CISA KEV), though a public POC exists via WPScan and SSVC rates the technical impact as total; EPSS remains very low at 0.12% (2nd percentile), consistent with the niche theme footprint.