Executive Summary

The vulnerability exists in the SignUp & SignIn plugin for WordPress, versions up to and including 1.0.0. It allows unauthenticated attackers to bypass authentication by exploiting weak password reset validation.

Specifically, the AJAX handler `pravel_change_password` is accessible without authentication and lacks nonce verification and capability checks. It performs only a loose equality check between an attacker-supplied reset code and the user's stored reset code, which can be trivially bypassed if the user has never initiated a password reset.

This flaw enables attackers to change the password of any WordPress user, including administrators, by sending a crafted POST request with the target user ID and a new password. Once exploited, the attacker can log in as that user and gain full control over the account.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a complete account takeover of any WordPress user on the affected site, including administrators.

An attacker can change user passwords without authentication, allowing them to gain unauthorized access and escalate privileges to administrator level.

Such unauthorized access can result in data breaches, site defacement, loss of control over the website, and potential further exploitation of the compromised system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized POST requests to the WordPress admin-ajax.php endpoint with the action parameter set to pravel_change_password.

• Check your web server logs for POST requests containing action=pravel_change_password.
• Use command-line tools like curl or wget to simulate such requests and verify if the password can be changed without authentication.
• Example command to detect vulnerability by attempting a password change (replace URL and parameters accordingly):
• curl -X POST https://yourwordpresssite.com/wp-admin/admin-ajax.php -d "action=pravel_change_password&reset_user_id=1&new_password_custom=Test1234"

If the request succeeds without authentication and changes the password, the site is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or removing the vulnerable SignUp & SignIn plugin until a patch is available.

Restrict access to the admin-ajax.php endpoint or specifically block requests with action=pravel_change_password from unauthenticated users via web application firewall or server rules.

Monitor user accounts for unauthorized password changes and reset passwords for critical accounts if compromise is suspected.

Apply any available updates or patches from the plugin developer as soon as they are released.

Useful 0 Not Useful 0