CVE-2023-4915

The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (in the WP User Control Widget). The function changes the user's password after providing the email. The new password is only sent to the user's email, so the attacker does not have access to the new password.

• CWE-620

• https://plugins.trac.wordpress.org/browser/wp-user-control/tags/1.5.3/inc/WPUserControlWidget.php#L893Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ca1736-7b99-49db-9367-586dbc14df41?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/wp-user-control/tags/1.5.3/inc/WPUserControlWidget.php#L893Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ca1736-7b99-49db-9367-586dbc14df41?source=cveThird Party Advisory

Published

Sep 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49144Out of bounds read in OpenBMC Firmware for some Intel(R) Ser…8.1
• CVE-2023-49145Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJS…5.4
• CVE-2023-49146DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via…6.1
• CVE-2023-49147An issue was discovered in PDF24 Creator 11.14.0. The config…7.8
• CVE-2023-49148Cross-Site Request Forgery (CSRF) vulnerability in Kulwant N…8.8
• CVE-2023-49149Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-49150Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-49151Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-49152Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-49153Cross-Site Request Forgery (CSRF) vulnerability in Saiful Is…8.8
• CVE-2023-49154Missing Authorization vulnerability in Wow-Company Button Ge…5.3
• CVE-2023-49155Cross-Site Request Forgery (CSRF) vulnerability in Wow-Compa…8.8