Authentication vulnerability in BoomBox Theme Extensions 1.8.0

The plugin called BoomBox Theme Extensions for WordPress has a security issue that allows someone to gain more privileges by taking control of an account. This can happen in all versions, including the most recent one. The problem is that the plugin does not check a user’s identity before letting them change their password using the ‘boombox_ajax_reset_password’ function. This means that attackers who are already logged in with at least subscriber privileges can change anyone’s password, even administrators, and use that to access their account.