AS Password Field In Default Registration Form WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability allowing account takeover has been identified in the AS Password Field In Default Registration Form plugin for WordPress, affecting all versions through 2.0.0. The vulnerability arises because the plugin fails to properly validate a user's identity before allowing password changes. This flaw enables unauthenticated attackers to alter passwords of any user, including administrators, thereby gaining unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, leading to account takeover, including administrative accounts.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.