Description

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-10T04:17:45.480Z",
  "pubdate": "2026-09-10T04:17:45.480Z",
  "executiveSummary": "The Bulk Password Reset WordPress plugin, in versions up to and including 1.3.3, contains a critical privilege escalation vulnerability.\nThe vulnerability stems from improper validation of user identity during administrative profile modification actions, allowing unauthorized changes to sensitive user data.\nSuccessful exploitation allows authenticated users, including those with minimal subscriber-level permissions, to perform a complete account takeover of any site user, including administrative accounts.\nBy modifying the email address associated with a target account, an attacker can initiate a password reset process to gain full control over the compromised account.\nThis represents a high-severity risk to site integrity and data security, as it bypasses standard access control mechanisms without requiring elevated initial privileges.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient access control check and a lack of proper identity verification within the Bulk Password Reset plugin's administrative logic. The plugin fails to validate that the user requesting a profile update has the appropriate authorization to modify the specific user record being targeted.\nThe vulnerability allows an authenticated user, starting from the subscriber level, to manipulate the account details of any other user within the WordPress installation. Specifically, the plugin permits the modification of sensitive fields, such as the email address associated with an account.\nThe attack flow proceeds as follows: First, the authenticated attacker sends a crafted request to the vulnerable plugin component. Because the plugin does not perform a robust server-side check against the current user's session privileges, the application accepts the request to modify a target user's account details.\nSecond, the attacker updates the target user's (e.g., an administrator's) email address to one controlled by the attacker. By changing the email address, the attacker effectively hijacks the WordPress 'Lost Password' mechanism.\nThird, the attacker triggers the native WordPress password reset functionality via the altered email address. The reset token is sent to the attacker-controlled email, allowing the attacker to establish a new password for the administrator account.\nAdditionally, the plugin allows the configuration of a custom, known value for password updates. An attacker can leverage this functionality to force-set a password to a predetermined string if the update logic permits, thereby bypassing the email-based reset flow entirely. Once the password is changed or the account is taken over, the attacker gains full administrative access to the WordPress dashboard, enabling the execution of arbitrary code, data exfiltration, or complete site defacement.\nThis vulnerability is present in all versions up to 1.3.3 and requires the attacker to have at least subscriber-level access to the WordPress site. The issue lies in the lack of capability checks within the plugin's action handlers, which assume that any authenticated user interacting with the plugin's features possesses the requisite permissions to perform sensitive database updates."
}