Custom Login Page Customizer WordPress Plugin Unauthenticated Arbitrary Password Reset Vulnerability

A vulnerability exists in the Custom Login Page Customizer WordPress plugin in versions prior to 2.5.4. The plugin lacks a proper password reset mechanism, allowing unauthenticated users to reset the passwords of any user, including administrators, by simply knowing their usernames. This flaw could be exploited to gain unauthorized access to user accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password resets, enabling attackers to gain access to user accounts, including those of administrators.

Remediation

Users are advised to update the Custom Login Page Customizer WordPress plugin to version 2.5.4 or later.