https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:53:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-283968 EUVD-2026-283968 https://cve.radiocsirt.org/vuln/euvd-2026-283968 https://cve.radiocsirt.org/vuln/fkie_cve-2024-8794 <p>The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user&#39;s identity prior to setting a password. This makes it possible for unauthenticated attackers to reset any user&#39;s passwords, including administrators. It&#39;s important to note that the attacker will not have access to the generated password, therefore, privilege escalation is not possible.</p> <p>The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user&#39;s identity prior to setting a password. This makes it possible for unauthenticated attackers to reset any user&#39;s passwords, including administrators. It&#39;s important to note that the attacker will not have access to the generated password, therefore, privilege escalation is not possible.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-8794 https://cve.radiocsirt.org/vuln/ghsa-w86j-8536-q955 <p>The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user&#39;s identity prior to setting a password. This makes it possible for unauthenticated attackers to reset any user&#39;s passwords, including administrators. It&#39;s important to note that the attacker will not have access to the generated password, therefore, privilege escalation is not possible.</p> <p>The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user&#39;s identity prior to setting a password. This makes it possible for unauthenticated attackers to reset any user&#39;s passwords, including administrators. It&#39;s important to note that the attacker will not have access to the generated password, therefore, privilege escalation is not possible.</p> https://cve.radiocsirt.org/vuln/ghsa-w86j-8536-q955