ID:10673 - Exploit for Weak Password Recovery Mechanism for Forgotten Password in WordPress - CVE-2020-11027

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise user accounts.

The vulnerability exists due to password reset token is not correctly invalidated. A remote attacker can abuse such behavior to take over another user account. 

Successful exploitation of the vulnerability may allows an attacker to gain full access to the affected website.

Remediation