Sala Startup & SaaS WordPress Theme Privilege Escalation Vulnerability Allowing Account Takeover

A privilege escalation vulnerability allowing account takeover has been identified in the Sala - Startup & SaaS WordPress Theme, affecting all versions through 1.1.4. The vulnerability arises because the theme fails to properly validate a user's identity before allowing password changes. This flaw enables unauthenticated attackers to reset passwords for any user, including administrators, and gain unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, leading to account takeover. This includes administrative accounts, which could be used to make further changes or cause additional harm on the site.