PT-2025-20484 · Unknown · Imithemes Listing

Alyudin Nafiie · Published 2025-05-09 · Updated 2025-05-09 · CVE-2025-2253

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IMITHEMES Listing plugin versions up to, and including, 3.3

Description The issue is related to privilege escalation via account takeover. This is due to the plugin not properly validating a verification code value prior to updating a user's password through the imic reset password init() function. This makes it possible for unauthenticated attackers to change any user's passwords, including administrators, if the user's email is known.

Recommendations For IMITHEMES Listing plugin versions up to, and including, 3.3, consider disabling the imic reset password init() function until a patch is available to prevent unauthenticated attackers from changing user passwords. Restrict access to password reset functionality to minimize the risk of exploitation. Avoid using the password reset feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2025-2253

Affected Products

Imithemes Listing

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-2253 · Security Note
• https://twitter.com/cybercronai/status/1920862681667350860 · Twitter Post
• https://themeforest.net/item/auto-stars-car-dealership-listings-wp-theme/11560490 · Note
• https://twitter.com/CVEnew/status/1920739446455988729 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4ed0ea4a-9cbf-4033-a31f-6cb954e8ce01?source=cve · Note
• https://t.me/cvenotify/121519 · Telegram Post