The Lenxel WP WordPress theme up to version 1.0.31 contains an unchecked password‑reset routine that validates only a CSRF nonce, bypassing any ownership or authorization check. This flaw allows an unauthenticated actor to replace the password of any user, including site administrators, thereby granting full control over the account. The weakness can lead to compromise of credentials, full administrative control of the website, and potential pivot to other systems.

All installations of the Lenxel WP theme version 1.0.31 or older are affected. The vulnerability applies to any WordPress site that has the theme activated and has not patched to a newer release.

The vulnerability is remotely exploitable via the website’s standard HTTP interface without requiring prior credentials. The EPSS score is reported as less than 1%, indicating a low but non‑zero probability of exploitation in the current landscape. It is not listed in the CISA KEV catalog, suggesting no publicly known widespread exploitation, but the impact of an unauthorized takeover remains severe. The CVSS score is 8.1, indicating high severity. Attackers can trigger the reset by sending a crafted request to the reset endpoint, bypassing all normal security controls.