8.8 Élevée

CVE-2024-12771 The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in…

Description

The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.43. This is due to missing or incorrect nonce validation on the 'customer_panel_password_reset' function. This makes it possible for unauthenticated attackers to reset the password of any administrator or customer account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
eCommerce Product Catalog Plugin for WordPress 3.3	premières → 3.3.43	Pas de correctif indiqué

Références

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org

Chronologie

Publiée 21 décembre 2024
Dernière modification 8 avril 2026

Les 7 CVE de eCommerce Product Catalog Plugin for WordPress →

CVE-2023-51688 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin… 5.3 Moyenne CVE-2023-47839 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode… 6.5 Moyenne CVE-2021-4392 The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in… 4.3 Moyenne CVE-2021-4393 The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in… 4.3 Moyenne

Suivre cette CVE