Critical · published June 27, 2025
🔥 A sneaky privilege escalation vulnerability in the DWT - Directory & Listing WordPress Theme could let anyone reset passwords for any user, even admins! Think of it as a restaurant where the staff don’t verify if a customer's order ticket is valid before serving up a three-course meal — any stranger could walk in and eat at the chef’s table! This could lead to an attacker gaining full access to an admin account, allowing them to wreak havoc on your entire site! They could modify settings, steal data, or even vandalize your content, making it a truly devastating scenario for website owners.
Think of it as a restaurant where the staff don’t verify if a customer's order ticket is valid before serving up a three-course meal — any stranger could walk in and eat at the chef’s table! The vulnerability exists because the plugin fails to validate whether a token is empty when executing the password reset function, allowing unauthenticated users to change passwords arbitrarily.
This could lead to an attacker gaining full access to an admin account, allowing them to wreak havoc on your entire site! They could modify settings, steal data, or even vandalize your content, making it a truly devastating scenario for website owners. To safeguard your site, immediately update the DWT theme to version 3.3.7 or higher. Additionally, review user account activity to ensure no unauthorized changes have occurred and consider strengthening your security practices with additional authentication measures. You've got this! Stay proactive and patch your theme to keep your site safe from these pesky attackers! 🛡️