StreamTube Core WordPress Plugin Password Change Vulnerability

A vulnerability allowing unauthenticated users to change passwords has been identified in the StreamTube Core plugin for WordPress, affecting versions through 4.78. This issue arises from the plugin's authorization bypass, which allows users to manipulate access to objects and resources. Exploitation is possible only if the 'registration password fields' option is enabled in the theme settings.

Impact

Exploitation of this vulnerability could lead to unauthorized password changes, potentially allowing attackers to gain control of user accounts, including those of administrators.

Remediation

Users are advised to update the StreamTube Core plugin to version 4.79 or a newer patched version.