CVE-2023-2449

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_process_form). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-2448 and CVE-2023-2446, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-620

Affected software

No affected versions have been published.

Timeline

Published: Nov 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-244904.3Users with only access to launch VDA applications can launch an unauthorized desktop CVE-2023-244917.8A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an attacker with acce CVE-2023-244928.8A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an attacker to remotely e CVE-2023-244935.7A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An au CVE-2023-244945.4A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it CVE-2023-244956.5A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. CVE-2023-244964.7Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-CVE-2023-244974.7Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-CVE-2023-244987.5An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config CVE-2023-244994.6Butterfly Button plugin may leave traces of its use on user's device. Since it is used for reporting domestic problems, this may lead to spo CVE-2023-24504.4The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version CVE-2023-245006.5Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.