Skip to content
Sign in
9.8 Critical

CVE-2024-12827 The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account…

Description

The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.6. This is due to the plugin not properly checking for an empty token value prior to resetting a user's password through the dwt_listing_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Affected products and versions

Product Affected versions Fixed in
DWT - Directory & Listing WordPress Theme 3.3 earliest → 3.3.6 No fix stated

Other CVEs of DWT - Directory & Listing WordPress Theme

The 3 CVEs of DWT - Directory & Listing WordPress Theme →
CVE-2025-0169 The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up… 6.4 Medium CVE-2025-0170 The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and… 6.1 Medium
Track this CVE