The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.6. This is due to the plugin not properly checking for an empty token value prior to resetting a user's password through the dwt_listing_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
The dwt_listing_reset_password() function responsible for resetting user passwords does not properly verify whether the passed token is empty. An attacker without any account can invoke this function with an empty token and set a new password for the selected user. This allows takeover of any account, including administrator accounts.
An attacker can change the password of any user, including administrators, and then log into the compromised account, gaining full control over the WordPress site, including the ability to install plugins, modify content, and access data.
The DWT - Directory & Listing theme should be updated to a version higher than 3.3.6. According to manufacturer references, available patches should be applied. As an additional measure, it is advisable to monitor logs for unauthorized password reset attempts.
WordPress theme 'DWT - Directory & Listing' in all versions up to and including 3.3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H