Critical · published January 6, 2026
🚨 An unauthenticated attacker can change any user's password, including admins, in the AS Password Field plugin for WordPress. 🔥 This is a privilege escalation nightmare waiting to happen! Think of it like a hotel front desk staff who hands out new room keys without checking IDs — chaos awaits when unauthorized guests stroll into the wrong rooms! An attacker could easily assume control of any account, including those of administrators, leading to a complete takeover of the site. This means they could change settings, delete content, or even install malicious code, creating a potentially catastrophic situation for the affected organization.
Think of it like a hotel front desk staff who hands out new room keys without checking IDs — chaos awaits when unauthorized guests stroll into the wrong rooms! The AS Password Field plugin fails to properly validate a user's identity when changing passwords, allowing an unauthenticated user to exploit this weakness and gain access to any account with a simple request.
An attacker could easily assume control of any account, including those of administrators, leading to a complete takeover of the site. This means they could change settings, delete content, or even install malicious code, creating a potentially catastrophic situation for the affected organization. Immediately update the AS Password Field plugin to version 2.0.1 or later. Additionally, implement stronger identity verification methods for password changes to ensure that only legitimate users can make such critical updates. You've got this! By taking these steps, you'll put your site back in secure hands. 🛡️