Critical · published January 7, 2026
🚨 An unauthenticated attacker can hijack any WordPress account with just a crafted password reset key! This is a legit game-changer for site security! 🔥 Think of this vulnerability like a hotel where anyone can walk in and request a master key to the rooms, even without checking in. The 'random_password' filter that sounds random is actually handing out the keys without verification! An attacker could easily reset any user's password, including administrators, and gain unauthorized access to sensitive information or functionalities. This can lead to data theft, website manipulation, or even complete takeover of the site. The consequences are nothing short of catastrophic for both the site's integrity and user trust!
Think of this vulnerability like a hotel where anyone can walk in and request a master key to the rooms, even without checking in. The 'random_password' filter that sounds random is actually handing out the keys without verification! The Optional Email plugin for WordPress fails to limit its 'random_password' filter to registration contexts. This oversight allows unauthorized users to set their own password reset keys, enabling them to reset passwords for any account.
An attacker could easily reset any user's password, including administrators, and gain unauthorized access to sensitive information or functionalities. This can lead to data theft, website manipulation, or even complete takeover of the site. The consequences are nothing short of catastrophic for both the site's integrity and user trust! Patch your WordPress site by updating the Optional Email plugin to version 1.3.12 or later immediately. Additionally, review your user account settings and consider implementing two-factor authentication for added security. Don't forget to audit any recent account changes! You've got this! By following these steps, you'll secure your site in no time and keep those pesky intruders out! 🛡️