WordPress Uix UserCenter Plugin Account Takeover

The Uix UserCenter WordPress plugin, up to version 1.0.3, has a critical security flaw. It does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester.

This allows unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.