The Buddypress Force Password Change plugin for WordPress is vulnerable because it does not properly validate the identity of the user before updating a password via the bp_force_password_ajax function. An authenticated attacker who has at least subscriber‑level access can call this AJAX endpoint and change the password of any user, including administrators, thereby gaining control of those accounts. The core weakness is a CWE‑620 type flaw that erodes the authentication boundary between requestor and target.

Lamarant’s Buddypress Force Password Change plugin for WordPress, any version up to and including 0.1 is affected. The vulnerability exists in the plugin code that processes password updates and does not check that the requester is the target account or an administrator.

With a CVSS score of 4.2 the severity is low, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. However, because it requires only an authenticated user with subscriber‑level role—which is a common role on many WordPress sites—an attacker could readily target any site that installs this plugin until a patch is applied. The attack vector is an authenticated AJAX call, so no special network privileges are needed beyond legitimate account access.