Executive Summary

This vulnerability exists in the Resideo Plugin for the Resideo - Real Estate WordPress Theme plugin for WordPress, affecting all versions up to and including 2.5.4. It allows an authenticated attacker with Subscriber-level access or higher to escalate their privileges by taking over other user accounts. This is possible because the plugin does not properly verify a user's identity before allowing updates to sensitive details like email addresses. An attacker can change another user's email address, including administrators, then use that to reset the user's password and gain access to their account.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact by allowing attackers with low-level access to escalate their privileges to administrator level. They can take over administrator accounts by changing email addresses and resetting passwords, potentially leading to full control over the WordPress site. This can result in unauthorized access, data breaches, site defacement, or other malicious activities.

Useful 0 Not Useful 0