A Reset Key That Forgets Its Owner
The password recovery page WP User Manager creates at install embeds a front-end form with no authentication or capability check: WPUM_Form::process() dispatches its step handlers on the WordPress 'wp' hook on every page load. In 2.6.2, the reset view checks the emailed key against the login of the URL's user_id — but the submission handler never inherits that check. reset_handler() re-reads user_id from the GET request and calls wp_set_password() with no key verification, capability check, or ownership check. The reset key proves only that the presenter controls the account it was issued for; here it authorizes a credential write on any numeric user ID, followed by destruction of the victim's sessions.
BitFire FREE: Bot Protection Blocks the Delivery
This attack travels as an automated front-end form submission: render the public reset form, then POST the step and password fields to the same unauthenticated page. BitFire FREE Bot Protection classifies that traffic before vulnerable WordPress code runs. Restricted automated clients cannot submit forms or POST data at all, and scripts and fake browsers that fail lightweight JavaScript browser verification never reach the reset handler. That cuts off the documented delivery path at the request layer, with no CVE-specific patch required. The boundary is honest: explicitly allowlisted bots and real browsers that pass verification are not categorically stopped, which is exactly why BitFire layers a second control behind this one.
BitFire PRO RASP: No Administrator Impersonation, No Takeover
The attack's payoff is the final step: authenticate as the administrator whose password was just rewritten. BitFire PRO RASP enforces authorization at that protected operation. Its administrator credential-evidence guard requires real authentication evidence — a valid logged-in cookie, application password, or equivalent approved WordPress credentials — and blocks administrator impersonation chains that lack it. An attacker armed only with a forged password has none, so the login that converts the password write into site control fails. RASP does not need to recognize CVE-2021-24655 and does not sanitize the original request; it blocks the dangerous runtime outcome. The guard covers administrator identities — the prize this exploit exists to claim.
The Fix in 2.6.3: Rebind the Key to Its Account
Version 2.6.3 restores the binding the vulnerable code discarded. The emailed reset link now carries the login and key through a redirect that stores them in an HttpOnly, path-scoped cookie, and both the reset view and reset_handler() re-derive identity from that cookie and call check_password_reset_key(). The reset target is taken from the verified WP_User object — $verify_key->ID — and the user_id GET parameter is gone. A valid key now authorizes resetting only the account it was issued for. If your site runs WP User Manager, update to 2.6.3 or later immediately; the plugin header's Version field is a read-only check for 2.6.2 versus 2.6.3.
If Your Site Was Affected, Investigate for Persistence
Patching closes the known path; it does not undo a compromise that already happened. If WP User Manager 2.6.2 or earlier ran on your site, assume an attacker may hold administrator credentials: patch, investigate, remove persistence, and rotate passwords and keys for privileged accounts. BitFire Threat Hunter performs a thorough post-compromise investigation and surfaces what this class of attacker leaves behind — backdoor WordPress administrator accounts, hidden database triggers, long-running PHP processes, and droppers that can restore malware or reinfect the site. A clean-looking file tree proves nothing. Run the investigation before you trust the site again.
Layer BitFire and Close This Door
CVE-2021-24655 turns a courtesy feature into an administrator takeover, but the chain hits two BitFire checkpoints. BitFire FREE Bot Protection stops the automated form POST that delivers the forged reset, and BitFire PRO RASP blocks the credential-less administrator impersonation needed to convert it into control — behavior-based protection that works without a CVE-specific patch. Run BitFire, update to WP User Manager 2.6.3, and let Threat Hunter clear any persistence an earlier compromise left behind. Enable BitFire today.
