CVE-2023-2449

The userpro_process_form function handling password reset uses a reset key in plaintext instead of its hashed value. Such a key can be read by an attacker — for example through SQL Injection in another plugin or theme installed on the site, or by exploiting related vulnerabilities CVE-2023-2448 or CVE-2023-2446. After obtaining the key, the attacker can directly invoke the reset function and set a new password for the chosen account. The entire attack requires no authentication, user interaction, or special privileges.

An attacker can take control of any user account — including WordPress administrator accounts — by setting a new password without the owner's knowledge. This results in a complete breach of the site's confidentiality, integrity, and availability.

The UserPro plugin must be updated immediately to a version higher than 5.1.1, according to information available from the vendor and in the references. It is also recommended to review other installed plugins and themes for SQL Injection vulnerabilities that could be used as a secondary attack vector.

UserPro plugin (Userproplugin Userpro) for WordPress in versions up to and including 5.1.1.