A critical authentication bypass vulnerability in the Pravel SignUp & SignIn plugin allows unauthenticated attackers to hijack any user account, including administrative accounts.

The plugin's pravel_change_password() AJAX handler lacks nonce verification and capability checks, while using a flawed equality check that allows unauthenticated attackers to reset passwords by supplying empty parameters.

Successful exploitation results in total account takeover, providing attackers with administrative access to the WordPress environment. Given the CVSS score of 9.8, this represents a critical risk that could lead to unauthorized data exfiltration, site defacement, and the installation of persistent malicious backdoors.

Immediate Action: Update the Pravel SignUp & SignIn plugin to the latest version immediately to patch the insecure AJAX handler.

Proactive Monitoring: Review admin-ajax.php access logs for unusual POST requests containing the pravel_change_password action and unexpected user ID targets.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the wp-admin/admin-ajax.php endpoint if immediate patching is not feasible.

Public Exploit Available: No

This vulnerability presents a severe risk to site integrity and security. Administrators must prioritize updating the plugin to the latest version to eliminate the possibility of unauthenticated account takeover and privilege escalation.