CVE-2024-35648: CSRF Vulnerability in Andy Moyle Emergency Password Reset 8.0

Technical summary

CVE-2024-35648 is a CSRF vulnerability (CWE-352) affecting the Emergency Password Reset plugin. The vulnerability stems from insufficient anti-CSRF protections in the password reset functionality. An attacker can forge requests that execute within the security context of an authenticated administrator or user session, allowing unauthorized password resets. The CVSS 3.1 score of 4.3 reflects a network-accessible, low-complexity attack requiring user interaction, with limited integrity impact and no confidentiality or availability damage in the base scenario.

Business impact

A successful CSRF attack could allow an attacker to reset passwords for user accounts without authorization, leading to account lockouts, unauthorized access if combined with credential stuffing, or disruption of emergency password recovery workflows. In organizations relying on this plugin for credential management, such attacks could compromise administrative access or frustrate legitimate users attempting to regain access to locked accounts.

Affected systems

Andy Moyle Emergency Password Reset plugin versions from initial release through version 8.0 are affected. The vendor product list is not populated in available data; organizations should verify their installed version against the plugin repository or documentation. Any WordPress site or compatible platform running this plugin at version 8.0 or earlier is potentially vulnerable.

Exploitability

This vulnerability requires user interaction—specifically, a user must visit an attacker-controlled page or click a malicious link while authenticated to the target system. No authentication is required from the attacker's perspective, and the attack vector is network-based with low complexity. However, the requirement for the victim to be logged into the vulnerable application and then interact with the attacker's payload limits the overall exploitability. This is not an unauthenticated remote code execution risk; it is a session-hijacking class of attack.

Remediation

Update the Emergency Password Reset plugin to a version newer than 8.0. Organizations should verify patch availability from the plugin author or official repository. If no patch is immediately available, consider temporarily disabling the plugin or restricting access to password reset functionality to trusted networks. Implement general CSRF defenses at the application level, such as SameSite cookie attributes and Content Security Policy headers.

Patch guidance

Check the Andy Moyle Emergency Password Reset plugin repository or the author's official advisory for versions released after June 2026. Apply available patches as soon as they are validated in a test environment. If the plugin is embedded in a larger application or custom stack, coordinate with your development team to ensure compatibility. Verify the patch resolves the CSRF token validation and request origin checks.

Detection guidance

Monitor for POST requests to password reset endpoints that originate from unexpected referrers or lack proper CSRF tokens. Log and alert on password reset actions triggered by users who did not initiate the request through the normal UI. Review web server access logs and WAF logs for patterns consistent with CSRF exploitation, such as requests with missing or invalid Referer headers. Implement application-level logging to track all password reset events, including timestamp, user, and request source.

Why prioritize this

Although this vulnerability carries a MEDIUM severity score, it directly threatens account security and administrative access. In environments where the Emergency Password Reset plugin is used to manage critical access workflows, CSRF attacks could enable account takeover or lockout scenarios. The plugin's name suggests it is deployed for emergency purposes, making it a high-value target. Prioritize patching in production environments, particularly where admin accounts are managed through this plugin. This vulnerability is not yet in the CISA KEV catalog, but organizations should not delay remediation based on KEV status alone.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects the attack vector (network, no special access required), complexity (low), and impact (limited to integrity—unauthorized password resets). The requirement for user interaction (UI:R) prevents a higher score. However, the contextual risk depends on deployment scope: if this plugin manages access to high-value systems or admin accounts, the true risk may exceed the base score. Organizations should factor in their threat landscape and the criticality of accounts managed by this plugin.

Frequently asked questions