In WordPress installations that use the SignUp & SignIn plugin, the AJAX handler for password changes is exposed to unauthenticated users. The handler performs no nonce verification, no capability check and uses a loose equality comparison between an attacker supplied code and the target user’s stored reset code. When the user has never requested a password reset, this stored value is empty, so an absent or empty attacker supplied code satisfies the check. Consequently a remote actor can send a crafted POST request to admin-ajax.php with action=pravel_change_password, specify the target user’s ID and a new password, and alter that user’s login credentials. The attacker can then authenticate as that user, including administrator accounts, achieving full privilege escalation.

All WordPress sites that have installed the SignUp & SignIn plugin version 1.0.0 or earlier are affected. The vulnerability exists in the plugin’s AJAX endpoint which is registered with wp_ajax_nopriv_pravel_change_password and is reachable by any user, regardless of authentication status.

The vulnerability carries a CVSS score of 9.8, reflecting a high severity for confidentiality, integrity, and availability for the affected site. No EPSS score is publicly available, and the issue is not listed in CISA’s KEV catalog. The attack vector is remote, requiring only an unauthenticated POST request to the plugin’s AJAX endpoint; no additional credentials or privileges are necessary. Successful exploitation allows an attacker to take over any account on the site, with potential to gain administrator-level access.