AdForest WordPress Theme Privilege Escalation Vulnerability Allowing Account Takeover

A vulnerability in the AdForest theme for WordPress, present in all versions through 5.1.6, allows for privilege escalation via account takeover. The issue arises because the theme's password reset function, adforest_reset_password(), fails to properly verify a user's identity before allowing password changes. This flaw enables unauthenticated attackers to reset passwords for any user, including administrators, and gain unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows unauthenticated attackers to change passwords of any user, including administrators, leading to unauthorized access to their accounts.

Remediation

Users can update to version 5.1.7 or a newer patched version to address this vulnerability.