Description
The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
alexacrm Dataverse Integration
Default version status: unaffected
2.77 to ≤ 2.81affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd35a3c-7203-4832-8b0d-56f3e7983118?source=cve ↗
- https://wordpress.org/plugins/integration-cds/#developers ↗
- https://plugins.trac.wordpress.org/browser/integration-cds/trunk/src/API/AuthenticatedEndpoint.php ↗
- https://plugins.trac.wordpress.org/browser/integration-cds/trunk/src/API/Endpoints/GetResetUserPasswordLink.php ↗
- https://plugins.trac.wordpress.org/changeset?new=3329717%40integration-cds%2Ftrunk&old=3323579%40integration-cds%2Ftrunk ↗