FS Registration Password WordPress Plugin Privilege Escalation Vulnerability via Account Takeover

A privilege escalation vulnerability allowing account takeover has been identified in the FS Registration Password plugin for WordPress, affecting all versions through 1.0.1. The issue arises because the plugin fails to properly verify a user's identity before allowing password changes. This flaw enables unauthenticated attackers to alter passwords of any user, including administrators, thereby gaining unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, leading to account takeover. This includes gaining access to accounts with administrative privileges.

Remediation

Users are advised to update the FS Registration Password plugin to version 2.0.1 or a newer patched version.