Motors WordPress Theme Privilege Escalation Vulnerability via Unauthenticated Password Change

A privilege escalation vulnerability has been identified in the Motors theme for WordPress, affecting all versions through 5.6.67. The issue arises because the theme fails to properly verify a user's identity before allowing password changes. This flaw enables unauthenticated attackers to reset passwords for any user, including administrators, and gain unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, leading to account takeovers, including those of administrators.

Remediation

Users can update to version 5.6.68 or a newer patched version to address this vulnerability.