Golo WordPress Theme Privilege Escalation Vulnerability via Unauthenticated Password Change

A privilege escalation vulnerability has been identified in the Golo - City Travel Guide WordPress Theme, affecting all versions through 1.6.10. The issue arises because the theme fails to properly validate a user's identity before allowing password changes. This flaw enables unauthenticated attackers to change passwords for any user, including administrators, potentially leading to unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, enabling attackers to gain access to user accounts, including those of administrators.

Remediation

Users are advised to update the Golo WordPress Theme to version 1.6.11 or a newer patched version.