Description

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T06:16:39.943Z",
  "pubdate": "2026-11-06T06:16:39.943Z",
  "executiveSummary": "The Placester WordPress plugin through version 1.4.3 contains a critical security vulnerability involving the lack of access control mechanisms within its AJAX request handling. This flaw is categorized as an improper access control vulnerability, which enables unauthenticated remote attackers to modify arbitrary user account details.\nThe primary risk is a complete account takeover. By exploiting the missing authorization checks, an attacker can modify the email address associated with any user, including administrative accounts. Once the email is changed, the attacker can leverage the WordPress password-reset functionality to gain full unauthorized control over the targeted account. This bypasses all standard authentication barriers, posing a severe threat to site integrity and data security. The vulnerability requires no authentication and can be executed via network-accessible requests, making it a high-priority risk for any WordPress site utilizing affected versions of the Placester plugin.",
  "technicalDetails": "The vulnerability originates from the improper implementation of an AJAX callback function within the Placester plugin (versions 1.4.3 and below) responsible for updating account information. The root cause is the total absence of security validation mechanisms, specifically missing nonce verification, capability checks (e.g., current_user_can), and ownership validation.\nIn WordPress development, AJAX handlers intended for administrative or sensitive user actions must verify the requester's identity using nonces to prevent Cross-Site Request Forgery (CSRF) and check user permissions to prevent unauthorized access. The affected code fails to execute these security checks, leaving the account update endpoint exposed to the public.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the vulnerable AJAX action handler. By crafting a malicious HTTP POST request targeting the admin-ajax.php endpoint, the attacker passes parameters intended to update user profile information. Because the backend does not validate the session or the identity of the requester, the plugin blindly accepts the input and updates the 'user_email' field in the WordPress database for the specified user ID.\nBy targeting an administrator's user ID, the attacker updates the email address to an account they control. Upon successful modification, the attacker triggers the standard WordPress password recovery process (wp-login.php?action=lostpassword). The password reset link is sent to the attacker-controlled email address rather than the legitimate administrator's email. Using this link, the attacker sets a new password, effectively bypassing authentication and achieving full administrative takeover of the WordPress instance.\nThis vulnerability is particularly dangerous because it requires zero interaction from the victim and no existing privileges on the target system. The network exposure is total, as the AJAX endpoint is accessible to any remote user capable of reaching the web server. The post-exploitation impact includes full system compromise, unauthorized access to sensitive site data, the potential for arbitrary code execution through administrative features (such as plugin or theme installation), and potential redirection of site traffic."
}