Adifier System WordPress Plugin Privilege Escalation Vulnerability Allowing Unauthenticated Password Reset

A vulnerability in the Adifier System plugin for WordPress, present in all versions through 3.1.7, allows for privilege escalation via account takeover. The issue arises because the plugin fails to properly validate a user's identity before updating account details, such as passwords, through the adifier_recover() function. This flaw enables unauthenticated attackers to reset passwords for any user, including administrators, and gain access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password resets, enabling attackers to take over user accounts, including those of administrators.

Remediation

Users can update to version 3.1.8 or a newer patched version to address this vulnerability.