ByteOS Network

CVE Vulnerability Details :

CVE-2026-12586

PUBLISHED

More Info Official Page

Assigner-WPScan

Assigner Org ID-1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81

Published At-02 Aug, 2026 | 06:00

Updated At-02 Aug, 2026 | 06:00

▼CVE Numbering Authority (CNA)

Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.

Affected Products

Vendor

Unknown

Product

Lenxel WP

Default Status

unknown

Versions

Affected

From 0 through 1.0.31 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-287	CWE-287 Improper Authentication
CWE	CWE-352	CWE-352 Cross-Site Request Forgery (CSRF)

Type: CWE

CWE ID: CWE-287

Description: CWE-287 Improper Authentication

Type: CWE

CWE ID: CWE-352

Description: CWE-352 Cross-Site Request Forgery (CSRF)

Credits

finder

moonge

coordinator

WPScan

References

Hyperlink	Resource
https://wpscan.com/vulnerability/84555dc3-b35e-478f-b681-ea0a0fe481d9/	exploit vdb-entry technical-description

Hyperlink: https://wpscan.com/vulnerability/84555dc3-b35e-478f-b681-ea0a0fe481d9/

Resource:

exploit

vdb-entry

technical-description

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References