Critical · published March 7, 2025
🚨 Uh-oh! Unauthenticated users can reset any WordPress admin's password with the InWave Jobs plugin, leaving doors wide open! 🔥 Think of it as a bakery where anyone can walk in and change the combination to the safe holding all the secret recipes — no entry fee required. This vulnerability lets an attacker reset any account's password and waltz right into the admin suite! If an attacker exploits this vulnerability, they could easily take over administrator accounts, modifying settings, posting malicious content, or even locking out legitimate users. The chaos it could unleash is nothing short of devastating, as they gain full control over your WordPress site!
Think of it as a bakery where anyone can walk in and change the combination to the safe holding all the secret recipes — no entry fee required. This vulnerability lets an attacker reset any account's password and waltz right into the admin suite! This privilege escalation vulnerability in the InWave Jobs plugin occurs because it fails to validate user identities before allowing password resets. This means any unauthenticated user can change passwords for any account, including those with admin privileges.
If an attacker exploits this vulnerability, they could easily take over administrator accounts, modifying settings, posting malicious content, or even locking out legitimate users. The chaos it could unleash is nothing short of devastating, as they gain full control over your WordPress site! To protect your site, immediately update the InWave Jobs plugin to version 3.5.2 or later. Additionally, implement a robust user verification process before granting any password changes. Regularly review user access and permissions to secure your site further. You've got this! By following these steps, you'll be reinforcing your site's defenses in no time. 🛡️