8.8
High
CVE-2024-12771 The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in…
Description
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.43. This is due to missing or incorrect nonce validation on the 'customer_panel_password_reset' function. This makes it possible for unauthenticated attackers to reset the password of any administrator or customer account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| eCommerce Product Catalog Plugin for WordPress 3.3 | earliest → 3.3.43 | No fix stated |
References
- www.wordfence.com www.wordfence.com
- plugins.trac.wordpress.org plugins.trac.wordpress.org
- plugins.trac.wordpress.org plugins.trac.wordpress.org
- plugins.trac.wordpress.org plugins.trac.wordpress.org
Timeline
- Published
- Last modified
Other CVEs of eCommerce Product Catalog Plugin for WordPress
The 7 CVEs of eCommerce Product Catalog Plugin for WordPress →
CVE-2023-51688
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin…
5.3
Medium
CVE-2023-47839
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode…
6.5
Medium
CVE-2021-4392
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in…
4.3
Medium
CVE-2021-4393
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in…
4.3
Medium