InWave Jobs WordPress Plugin Privilege Escalation Vulnerability via Password Reset

A privilege escalation vulnerability has been identified in the InWave Jobs plugin for WordPress, affecting all versions through 3.5.1. The issue arises because the plugin fails to properly verify a user's identity before allowing password changes. This flaw enables unauthenticated attackers to reset passwords for any user, including administrators, potentially leading to unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password resets, enabling attackers to gain access to user accounts, including those of administrators.