PT-2024-17730 · WordPress · Ecommerce Product Catalog Plugin
Khayal Farzaliyev
+1
·
Published
2024-12-21
·
Updated
2024-12-21
·
CVE-2024-12771
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
eCommerce Product Catalog Plugin for WordPress versions up to, and including, 3.3.43
Description
The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the
customer panel password reset function. This allows unauthenticated attackers to reset the password of any administrator or customer account via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.Recommendations
For versions up to, and including, 3.3.43, update to a version that includes the fix for the nonce validation issue in the
customer panel password reset function to prevent unauthorized password resets.
As a temporary workaround, consider restricting access to the customer panel password reset function until a patch is available.Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ecommerce Product Catalog Plugin