A critical vulnerability in the Custom Login Page Customizer WordPress plugin allows unauthenticated attackers to hijack user accounts, including administrator accounts, by resetting passwords.

This flaw is classified as improper privilege management (CWE-269), where the plugin fails to implement a secure password reset process. An unauthenticated attacker can trigger a password reset for any user, including administrators, simply by knowing the target username.

The ability for an unauthenticated attacker to reset administrative passwords represents a total compromise of the application and its underlying data. This could result in unauthorized access to sensitive user information, full site takeover, and potential injection of malicious content, leading to severe reputational and operational damage. With a CVSS score of 8.1, this is a high-severity risk that requires immediate attention to prevent account takeover incidents.

Immediate Action: Update the Custom Login Page Customizer plugin to version 2.5.4 or later immediately to resolve the vulnerable password reset logic.

Proactive Monitoring: Review WordPress user account activity logs for suspicious password resets or unexpected changes to administrative account credentials.

Compensating Controls: If an immediate update is not possible, deactivate the plugin entirely until a patch can be applied, or implement a Web Application Firewall (WAF) rule to block unauthorized requests to the plugin's password reset endpoints.

Public Exploit Available: Unknown.

Given the potential for complete account takeover, organizations utilizing the Custom Login Page Customizer plugin must prioritize this update. Verify that all administrative accounts are protected by multi-factor authentication, as this provides a critical layer of defense against password reset vulnerabilities. Apply the patch to version 2.5.4 immediately to eliminate the risk of unauthenticated account compromise.