Unauthenticated Email Hijacking in Placester WordPress Plugin

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Placester WordPress plugin through version 1.4.3 contains a critical privilege escalation vulnerability that allows unauthenticated attackers to modify any user's email address, including administrators, without requiring authentication, nonce verification, or ownership validation. This vulnerability is particularly dangerous because email addresses serve as the primary recovery mechanism for account access—by changing an administrator's email, attackers can reset passwords and gain complete control over WordPress installations. Organizations running vulnerable versions of this plugin face immediate risk of account takeover, data breach, and complete site compromise, affecting any WordPress site with Placester installed and active.

Casky's 224 matching security skills leverage Claude AI with extended reasoning to identify the attack patterns mapped to MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would detect this vulnerability through patterns including: missing capability checks on AJAX handlers, absent nonce validation on state-changing operations, and direct object reference vulnerabilities in user account modification endpoints. When analyzing the Placester plugin, Casky's skills would flag the unprotected AJAX action, trace the account update flow, and surface the authentication bypass allowing unauthenticated email modification—correlating these findings to the privilege escalation technique and recommending immediate patching to versions 1.4.4 or later, plus monitoring for exploitation attempts targeting administrator account recovery flows.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-113584.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-113584

Casky has 224 skills that investigate the attack patterns behind CVE-2026-113584. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn