The Themes Coder plugin for WooCommerce sites suffers from an authentication bypass vulnerability (CWE-288) due to insufficient validation of user identity before allowing password updates via the update_user_profile() function. This weakness permits unauthenticated attackers to reset passwords of any user, including administrators, leading to privilege escalation and full account takeover. The vulnerability affects all versions up to and including 1.3.4. It is remotely exploitable without authentication and requires no user interaction. The CVSS 3.1 base score is 9.8, reflecting critical severity with network attack vector, low attack complexity, and no privileges required.

Successful exploitation allows an unauthenticated attacker to change any user's password, including administrators, resulting in full account takeover. This compromises confidentiality, integrity, and availability of the affected WordPress site and potentially any connected systems or data. Given the administrative access gained, attackers can perform any action on the site, including data theft, site defacement, or further malware deployment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and monitor for suspicious activity. Consider disabling or removing the plugin if possible to prevent exploitation. Avoid relying on generic mitigations as this vulnerability allows unauthenticated password changes.