CVE-2026-12586
Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset
CVSS Score
8.1
EPSS Score
0.1%
EPSS Percentile
2th
The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.
| Vendor | unknown |
| Product | lenxel wp |
| Published | Aug 2, 2026 |
| Last Updated | Aug 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown lenxel wp
Be the first to know when new high vulnerabilities affecting unknown lenxel wp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Lenxel WP
0 ≤ 1.0.31
References
Credits
moonge WPScan