Security Issue – Break in!
-
You can enter a system using this plugin and get the role assigned by default for new users (e.g. author but at least subscriber and then you can do posts!)
Testcase
1. Register as a new user
2. after register, Lost password, suing EMAIL (username does not work as encrypted temporarily and unknown
3. you get email send with reset LINK
4. Click and visit reset page
5. enter your encrypted username (taken from reset email)
6. enter an new password
7. Login with
– encrypted username
– new password from reset procedureet voilà…you are in!
Looking at the poor support response here in WP forum and that Facebook has not had any updates since 2-3 years…
Wonder, how the update in January happened!T>his must be fixed!
Viewing 3 replies - 1 through 3 (of 3 total)
Viewing 3 replies - 1 through 3 (of 3 total)
- The topic ‘Security Issue – Break in!’ is closed to new replies.
