Authentication vulnerability in WP User Control 1.5.3

The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to and including 1.5.3. This means that if someone knows the email address associated with your account, they can change your password without requiring your permission. The plugin uses native password reset functionality, which should have been more secure, but it does not properly check the password reset function (the WP User Control Widget). When a user’s email is provided, the new password is automatically sent to the user’s email address without the attacker having access to the new password.