PT-2025-1831 · WordPress · The Themes Coder – Create Android & Ios Apps For Your Woocommerce Site
Tieu Pham Trong Nhan
·
Published
2025-01-07
·
Updated
2025-01-12
·
CVE-2024-12402
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress versions up to, and including, 1.3.4
Description
The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior to updating their password through the
update user profile() function. This allows unauthenticated attackers to change arbitrary user's passwords, including administrators, and gain access to their account.Recommendations
For versions up to, and including, 1.3.4, update to a version that properly validates user identity before allowing password updates, or as a temporary workaround, consider disabling the
update user profile() function until a patch is available. Restrict access to user profile updates to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Authentication Bypass Using an Alternate Path or Channel
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
The Themes Coder – Create Android & Ios Apps For Your Woocommerce Site