CVE-2026-12586CWE-287CWE-352csrf
CVE-2026-12586
High · published August 2, 2026
What it is
The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.
The record
Technical detail
- CVSS v3.1
- 8.1 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00200 · 9.4th percentile
- Weaknesses
- CWE-287 · Improper Authentication; CWE-352 · Cross-Site Request Forgery (CSRF)
- Published
- 2026-08-02T10:16Z
References (1)
EPSS history
Timeline