This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: Unauthenticated Privilege Escalation in WordPress Theme 'Sala'.
💥 **Consequences**: Attackers can hijack ANY account (even Admins) via password reset. Total site takeover possible. 📉
📦 **Product**: Sala - Startup & SaaS WordPress Theme.
🏢 **Vendor**: uxper.
📅 **Affected**: Versions **<= 1.1.4**. If you are on 1.1.4 or older, you are at risk! ⚠️
Q4What can hackers do? (Privileges/Data)
👑 **Privileges**: Full Admin Access.
🔓 **Data**: Complete Account Takeover.
Hackers can reset passwords for **arbitrary users**, including Super Admins. No password needed to initiate the reset. 💀
Q5Is exploitation threshold high? (Auth/Config)
📉 **Threshold: LOW**.
🔑 **Auth**: None required (Unauthenticated).
⚙️ **Config**: Direct AJAX endpoint exposure. Easy to trigger via simple HTTP requests. 🚀
Q6Is there a public Exp? (PoC/Wild Exploitation)
🔥 **Yes, Public PoCs Exist**.
👀 **GitHub**: Multiple exploits available (e.g., Yucaerin, UcenHaxor07).
🌐 **Wild Exploitation**: High risk. Automated scanners likely already targeting this. 🕷️
Q7How to self-check? (Features/Scanning)
🔍 **Check**: Look for `wp_ajax_nopriv_change_password_ajax` in theme code.
📡 **Scan**: Use WPScan or manual AJAX fuzzing on `/wp-admin/admin-ajax.php`.
🧪 **Test**: Try resetting a password without being logged in.…
🛠️ **Fix**: Update to version **> 1.1.4** immediately.
📢 **Official**: Check vendor 'uxper' for the patched release. Do not ignore updates! 📥
Q9What if no patch? (Workaround)
🚧 **No Patch?**: Disable the `change_password_ajax` function via code snippet.
🛑 **Mitigation**: Block access to `admin-ajax.php` for non-authenticated users if possible.…