Frontend Login and Registration Blocks Privilege Escalation Vulnerability in WordPress

A privilege escalation vulnerability allowing account takeover has been identified in the Frontend Login and Registration Blocks plugin for WordPress, affecting all versions through 1.0.7. The vulnerability arises because the plugin fails to properly verify a user's identity before allowing updates to user details such as email addresses. This flaw enables unauthenticated attackers to change the email addresses of any user, including administrators. Once the email is changed, the attacker can reset the user's password and gain access to their account.

Impact

Exploitation of this vulnerability allows for unauthorized users to gain access to other users' accounts, including those of administrators, by changing their email addresses and resetting their passwords.