Security Flaw in WordPress Plugin Puts 22,000 Websites at Risk of Cyber Attacks

Critical security vulnerability has been discovered in Motors, a popular WordPress theme with over 22,000 sales, potentially exposing thousands of websites to complete takeover.

Security researchers at Wordfence identified an unauthenticated privilege escalation vulnerability that allows attackers to change passwords of any user, including administrators, without requiring prior authentication.

The vulnerability, identified as CVE-2025-4322 with a critical CVSS rating of 9.8, was discovered by security researcher Foxyyy through Wordfence’s Bug Bounty Program and has since been patched in version 5.6.68.

The security flaw in Motors theme versions 5.6.67 and earlier enables unauthenticated attackers to reset passwords for any user account on affected websites.

This privilege escalation vulnerability is particularly dangerous as it requires no authentication and can target administrator accounts, giving attackers complete control over compromised websites.

Once administrative access is gained, attackers can upload malicious files, inject malware, redirect users to phishing sites, or modify website content.

“This vulnerability makes it possible for unauthenticated threat actors to easily take over websites by resetting the password of any user, including administrators,” Wordfence explained in their report.

The researcher who discovered this critical flaw received a $1,073 bounty, which included a 10% bonus for providing a comprehensive, easily reproducible proof-of-concept.

Technical Breakdown of the Exploit

The vulnerability stems from improper validation in the password recovery function within the Motors theme.

Specifically, the password-recovery.php template fails to properly validate a user’s identity before processing password updates.

While the code does include a hash comparison mechanism intended to verify legitimate password reset requests, researchers discovered a critical bypass.

The vulnerability exploits two key weaknesses in the theme’s code: first, the system fails to validate whether a password reset was actually requested, and second, attackers can bypass the hash check by supplying an invalid UTF-8 character in the hash_check parameter.

This character gets stripped by the esc_attr() function after the initial !empty() check but before the comparison, effectively allowing password changes without a valid hash.

The technical flaw is particularly dangerous because most users don’t have active password reset requests, making the majority of Motors-powered vulnerable to this attack vector.

Patch Deployment and Protection Measures

StylemixThemes, the developer of Motors, released a patched version on May 14, 2025, after being notified of the vulnerability on May 5.

The fix is available in version 5.6.68, and all site owners using the Motors theme are strongly urged to update immediately.

Wordfence has implemented protective measures for users of its security services.

Premium, Care, and Response subscribers received firewall protection against this exploit on May 6, while free Wordfence users will receive the same protection on June 5, 2025.

“We would like to commend the StylemixThemes team for their prompt response and timely patch,” noted Wordfence in their disclosure timeline.

Site owners are advised to verify their theme version and update promptly given the critical nature of this vulnerability.

Security experts also recommend implementing additional security layers including strong passwords, two-factor authentication, and regular security audits to protect WordPress installations from similar threats.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!