CVE-2026-113584: placester WordPress Plugin Unauthenticated Account Takeover

CVE-2026-113584: placester Account Takeover

A critical access control flaw affects the placester WordPress plugin. Tracked as CVE-2026-113584 (CVSS 9.8, Critical), an AJAX action that updates account details performs no capability, nonce or ownership check. Unauthenticated attackers can overwrite any user's email address, including an administrator's, and then take over the account through the standard password reset flow.

Vulnerability Overview

Attack Flow

1. The attacker sends a crafted request to the vulnerable AJAX action without logging in.
2. The administrator's email address is replaced with one the attacker controls.
3. The attacker triggers WordPress's password reset and receives the reset link.
4. The attacker logs in as the administrator.

Remediation

1. Identify WordPress sites running placester.
2. Update to a fixed version if one is available. The NVD entry did not list one at publication, so deactivate and remove the plugin if no fix exists.
3. Audit administrator email addresses for unexpected changes and review password reset activity.
4. Rotate administrator credentials and invalidate active sessions if exposure is suspected.

References

• NVD: CVE-2026-113584