CVE-2026-12586

HighCVSS 8.1/10Last modified Aug 26, 2026

Description

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Aug 2, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-125878.6The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the applica CVE-2026-1258704.2BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allows authenticated CVE-2026-1258716.3The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user wit CVE-2026-1258788.7Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injec CVE-2026-1258798.6Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 26.4.1.CVE-2026-125886.0An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection w CVE-2026-1258808.3Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). This issu CVE-2026-1258819.3Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue affects N-central: befo CVE-2026-1258828.6Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 26.4.1.CVE-2026-1258839.3Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-c CVE-2026-125905.9Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option CVE-2026-125919.9Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission v