miniOrange Password Policy Manager Authentication Bypass Vulnerability

An authentication bypass vulnerability allowing authentication abuse has been identified in the miniOrange Password Policy Manager WordPress plugin, affecting versions through 2.0.4. This vulnerability allows malicious actors to perform actions typically reserved for users with higher privileges, potentially leading to unauthorized admin access.

Impact

Exploitation of this vulnerability could result in unauthorized administrative access to the WordPress site.

Remediation

Users of the miniOrange Password Policy Manager WordPress plugin are advised to update to version 2.0.4 or later. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate this vulnerability.