CVE-2024-12860

CRITICAL Year: 2024
CVSS v3 Score
9.8
Critical
Weakness Type
CWE-620
View all →

Vulnerability Description

The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Related Vulnerabilities

CVE-2024-12824

CRITICAL
CVSS:9.8(Critical)

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly...

CWE-6202024

CVE-2024-13375

CRITICAL
CVSS:9.8(Critical)

The Adifier System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.1.7. This is due to the plugin not properly validating a user...

CWE-6202024

CVE-2024-26520

CRITICAL
CVSS:9.8(Critical)

An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authentication and perform arbitrary password resets...

CWE-6202024

CVE-2024-37998

CRITICAL
CVSS:9.8(Critical)

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). The password of administrative accounts of the affect...

CWE-6202024

CVE-2024-45647

CRITICAL
CVSS:9.8(Critical)

IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prio...

CWE-6202024

CVE-2024-48887

CRITICAL
CVSS:9.8(Critical)

A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request

CWE-6202024