CarSpot WordPress Theme Privilege Escalation Vulnerability Allowing Account Takeover

A vulnerability in the CarSpot – Dealership WordPress Classified Theme, affecting all versions through 2.4.3, allows for privilege escalation via account takeover. The issue arises because the theme fails to properly validate a token before updating a user's password. This flaw enables unauthenticated attackers to reset passwords for any user, including administrators, and gain access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password resets, leading to account takeovers, including those of administrators.

Remediation

Users are advised to update the theme to version 2.4.4 or a newer patched version.