CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Explanation of Vulnerability in Simple Terms
CarSpot Dealership WordPress theme versions 2.4.3 and earlier contain a critical vulnerability that allows unauthenticated attackers to read sensitive data, modify site content, and disrupt service. No user interaction or special privileges are required—the vulnerability is exploitable directly over the network. All sites running affected versions require immediate update.
What an attacker can do
Read sensitive data, modify or delete content, and disrupt site availability without authentication.
Potential impact on your site
Your site's data, content, and availability are at risk from any internet user without requiring a login.
Conditions required to exploit
Network access only; no authentication, user interaction, or special privileges required.
Key dates
External resources
Related vulnerabilities
