THREAT OPS › Threat News › [NVD] CVE-2026-12586 — The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the accou
[NVD] CVE-2026-12586 — The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the accou
CVE-2026-12586 CVSS: None Published: 2026-08-02T06:16:34.223
The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.
Indicators of compromise
- CVE-2026-12586cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-12586