Buddypress Force Password Change Authenticated Account Takeover Vulnerability

A vulnerability in the Buddypress Force Password Change plugin for WordPress, present in all versions through 0.1, allows authenticated users with subscriber-level access and above to take over accounts by changing passwords. The vulnerability arises because the plugin fails to properly verify a user's identity before password updates, particularly through the 'bp_force_password_ajax' function. This flaw enables attackers to reset passwords of any user, including administrators, and gain unauthorized access to their accounts.

Impact

Exploitation of this vulnerability could lead to unauthorized account access, allowing attackers to impersonate the affected users.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.