CVE-2025-2253

CRITICAL Year: 2025
CVSS v3 Score
9.8
Critical
Weakness Type
CWE-620
View all →

Vulnerability Description

The IMITHEMES Listing plugin is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3. This is due to the plugin not properly validating a verification code value prior to updating their password through the imic_reset_password_init() function. This makes it possible for unauthenticated attackers to change any user's passwords, including administrators if the users email is known.

Related Vulnerabilities

CVE-2024-12824

CRITICAL
CVSS:9.8(Critical)

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly...

CWE-6202024

CVE-2024-12860

CRITICAL
CVSS:9.8(Critical)

The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugi...

CWE-6202024

CVE-2024-13375

CRITICAL
CVSS:9.8(Critical)

The Adifier System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.1.7. This is due to the plugin not properly validating a user...

CWE-6202024

CVE-2024-26520

CRITICAL
CVSS:9.8(Critical)

An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authentication and perform arbitrary password resets...

CWE-6202024

CVE-2024-37998

CRITICAL
CVSS:9.8(Critical)

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). The password of administrative accounts of the affect...

CWE-6202024

CVE-2024-45647

CRITICAL
CVSS:9.8(Critical)

IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prio...

CWE-6202024