CVE-2026-12586 | BDVDB-2026-354645 Detail

Description#

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-02Record published in the CVE List.
2. Version 22026-08-04Most recent update recorded in the CVE List.