Account takeover via attacker-controlled password-reset key

Improper privilege management in LoginPress Custom Login Page Customizer before 2.5.4 allows remote attackers to take over user accounts. The lost-password flow accepts an attacker-supplied user_pass value as the reset key, letting subsequent reset requests replace the named user's password without the emailed key. Exploitation requires public registration and the Custom Password Fields option to be enabled; knowing a username is enough to seize that account, including an administrator account.