Now officially on WordPress.org

CVE Database / CVE-2024-12771

CVE · High

CVE-2024-12771 — eCommerce Product Catalog [ecommerce-product-catalog] < 3.3.44

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-12771 eCommerce Product Catalog [ecommerce-product-catalog] < 3.3.44 Cross-Site Request Forgery (CSRF) High 8.8 < 3.3.44 3.3.44 2024-12-20 —

CVE-2024-12771

The eCommerce Product Catalog Plugin for WordPress through version 3.3.43 contains a cross-site request forgery vulnerability in the customer_panel_password_reset function due to insufficient nonce verification. Unauthenticated attackers can exploit this weakness to reset passwords for administrator and customer accounts by crafting a malicious request, provided they can convince a site administrator to click a specially designed link or interact with forged content.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings