Privilege Escalation Vulnerability in DWT - Directory & Listing WordPress Theme

CVE-2024-12827

What is CVE-2024-12827?

The DWT - Directory & Listing WordPress Theme is susceptible to a privilege escalation flaw that enables unauthenticated attackers to reset any user's password, including those belonging to administrators. This security weakness arises due to inadequate validation of token values in the password reset function, dwt_listing_reset_password(). Attackers exploiting this vulnerability can take over accounts and gain unauthorized access to sensitive information and functionalities. Website owners utilizing this theme should implement protective measures and update to the latest version to mitigate potential risks.

References