Description (CNA)
The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.5.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| dreamstechnologies / Doccure | affected 0 through 1.5.0 |
CWE
CWE-639
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8b1d8f-b2b6-415c-91f2-e5b98048258d?source=cve
- https://themeforest.net/item/doccure-medical-wordpress-theme/34329202
ADP enrichment
No English description supplied.
No references supplied.