Executive brief
The Lenxel WP WordPress theme contains a critical flaw in its password-reset functionality that allows unauthenticated attackers to reset the password of any user, including administrators. By exploiting this vulnerability, an attacker can take complete control of WordPress accounts without any valid credentials, leading to full account takeover and potential compromise of the entire site.
Technical details
The vulnerability is an authentication bypass in the password-reset action handler that performs insufficient authorization checks. The password-reset endpoint validates only a CSRF nonce but does not verify user ownership or require authentication before allowing password changes. An unauthenticated attacker can retrieve the CSRF nonce from the publicly accessible reset-password template page, then POST arbitrary user IDs with a new password directly to the site root. The handler, registered on the `init` hook rather than `admin-ajax.php`, processes the request without verifying the user's identity, enabling account takeover of any user including administrators. As of the last update, no patch has been released for theme versions through 1.0.31.
Affected products
- Lenxel Lenxel WP through 1.0.31
Timeline
- 2026-07-21: disclosed
- 2026-08-02: advisory