Q: What can hackers do? (Privileges/Data)

👑 **Privileges**: Full Admin Access. 🔓 **Data**: Complete Account Takeover. Hackers can reset passwords for **arbitrary users**, including Super Admins. No password needed to initiate the reset. 💀

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold: LOW**. 🔑 **Auth**: None required (Unauthenticated). ⚙️ **Config**: Direct AJAX endpoint exposure. Easy to trigger via simple HTTP requests. 🚀

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Yes, Public PoCs Exist**. 👀 **GitHub**: Multiple exploits available (e.g., Yucaerin, UcenHaxor07). 🌐 **Wild Exploitation**: High risk. Automated scanners likely already targeting this. 🕷️

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Update to version **> 1.1.4** immediately. 📢 **Official**: Check vendor 'uxper' for the patched release. Do not ignore updates! 📥

Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: Unauthenticated Privilege Escalation in WordPress Theme 'Sala'. 💥 **Consequences**: Attackers can hijack ANY account (even Admins) via password reset. Total site takeover possible. 📉

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **CWE-620**: Unverified Password Reset Token. 🔍 **Flaw**: The `change_password_ajax` endpoint lacks identity verification.…

Question 3

Who is affected? (Versions/Components)

Accepted Answer

📦 **Product**: Sala - Startup & SaaS WordPress Theme. 🏢 **Vendor**: uxper. 📅 **Affected**: Versions **<= 1.1.4**. If you are on 1.1.4 or older, you are at risk! ⚠️

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

👑 **Privileges**: Full Admin Access. 🔓 **Data**: Complete Account Takeover. Hackers can reset passwords for **arbitrary users**, including Super Admins. No password needed to initiate the reset. 💀

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

📉 **Threshold: LOW**. 🔑 **Auth**: None required (Unauthenticated). ⚙️ **Config**: Direct AJAX endpoint exposure. Easy to trigger via simple HTTP requests. 🚀

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

🔥 **Yes, Public PoCs Exist**. 👀 **GitHub**: Multiple exploits available (e.g., Yucaerin, UcenHaxor07). 🌐 **Wild Exploitation**: High risk. Automated scanners likely already targeting this. 🕷️

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Check**: Look for `wp_ajax_nopriv_change_password_ajax` in theme code. 📡 **Scan**: Use WPScan or manual AJAX fuzzing on `/wp-admin/admin-ajax.php`. 🧪 **Test**: Try resetting a password without being logged in.…

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

🛠️ **Fix**: Update to version **> 1.1.4** immediately. 📢 **Official**: Check vendor 'uxper' for the patched release. Do not ignore updates! 📥

Question 9

What if no patch? (Workaround)

Accepted Answer

🚧 **No Patch?**: Disable the `change_password_ajax` function via code snippet. 🛑 **Mitigation**: Block access to `admin-ajax.php` for non-authenticated users if possible.…

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🔴 **Priority: CRITICAL**. ⏰ **Urgency**: Immediate action required. CVSS Score: **9.8** (High). Zero-day style impact. Patch NOW or risk total compromise. 🏃‍♂️💨

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-4606 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring