https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:25:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-351264 EUVD-2026-351264 https://cve.radiocsirt.org/vuln/euvd-2026-351264 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18030 <p>The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account.</p> <p>Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8&#39;s password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.</p> <p>The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account.</p> <p>Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8&#39;s password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18030 https://cve.radiocsirt.org/vuln/ghsa-3w5j-v478-4p9q <p>The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account.</p> <p>Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8&#39;s password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.</p> <p>The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account.</p> <p>Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8&#39;s password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.</p> https://cve.radiocsirt.org/vuln/ghsa-3w5j-v478-4p9q