Executive brief
The SignUp & SignIn plugin for WordPress, which manages user registration and login functionality, contains a critical security flaw in its password reset process. An unauthorized attacker can exploit this flaw to change the password of any user account, including site administrators, without needing any existing credentials. This allows for a complete takeover of the website, potentially leading to data theft, site defacement, or further malicious activity.
Technical details
The vulnerability exists in the `pravel_change_password()` AJAX handler, which is registered via `wp_ajax_nopriv_pravel_change_password` and accessible to unauthenticated users. The function lacks nonce verification and capability checks, and it performs a loose equality check between an attacker-supplied `reset_activation_code` and the user's `forgot_email` meta value. Because `get_user_meta()` returns an empty string for users who have never initiated a password reset, an attacker can satisfy the check by providing an empty or omitted code. By sending a crafted POST request to `admin-ajax.php` with a target `reset_user_id`, an attacker can reset any user's password and achieve full administrative privilege escalation.
Affected products
- pravel SignUp & SignIn up to, and including, 1.0.0
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/signup-signin/tags/1.0.0/lib/function.php
- https://plugins.trac.wordpress.org/browser/signup-signin/tags/1.0.0/lib/function.php
- https://plugins.trac.wordpress.org/browser/signup-signin/tags/1.0.0/lib/function.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a617fc-da3d-4828-b027-44093dd11769?source=cve