CVE-2024-12771

The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.43. This is due to missing or incorrect nonce validation on the 'customer_panel_password_reset' function. This makes it possible for unauthenticated attackers to reset the password of any administrator or customer account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/ecommerce-product-catalog/trunk/modules/cart/includes/customers/includes/transactions/customer-panel.php#L108
• https://plugins.trac.wordpress.org/browser/ecommerce-product-catalog/trunk/modules/cart/includes/customers/includes/transactions/customer-panel.php#L44
• https://plugins.trac.wordpress.org/changeset/3210939/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3513ec24-0b1b-4528-9f89-eee5654e4e98?source=cve

Published

Dec 21, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12766parisneo/lollms-webui version V13 (feather) suffers from a S…7.5
• CVE-2024-12767The buddyboss-platform WordPress plugin before 2.7.60 lacks …3.5
• CVE-2024-12768The Responsive iframe WordPress plugin through 1.2.0 does no…5.4
• CVE-2024-12769The Simple Banner WordPress plugin before 3.0.4 does not sa…3.5
• CVE-2024-1277The Ocean Extra plugin for WordPress is vulnerable to Stored…5.4
• CVE-2024-12770The WP ULike WordPress plugin before 4.7.6 does not sanitis…4.8
• CVE-2024-12772The Ninja Tables WordPress plugin before 5.0.17 does not sa…5.4
• CVE-2024-12773The Altra Side Menu WordPress plugin through 2.0 does not sa…7.2
• CVE-2024-12774The Altra Side Menu WordPress plugin through 2.0 does not ha…6.5
• CVE-2024-12775langgenius/dify version 0.10.1 contains a Server-Side Reques…6.5
• CVE-2024-12776In langgenius/dify v0.10.1, the `/forgot-password/resets` en…8.1
• CVE-2024-12777A vulnerability in aimhubio/aim version 3.25.0 allows for a …5.9