The implecode eCommerce Product Catalog Plugin for WordPress contains a CSRF vulnerability (CWE-352) in the 'customer_panel_password_reset' function due to missing or incorrect nonce validation. This flaw allows an attacker to craft a forged request that, when executed by a site administrator (e.g., via clicking a link), can reset the password of any administrator or customer account. The vulnerability affects all plugin versions up to 3.3.43 and has a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory with remediation details is currently available.

Successful exploitation enables an unauthenticated attacker to reset passwords of administrator or customer accounts by tricking an authenticated site administrator into executing a malicious request. This can lead to full account takeover, compromising site control and user data confidentiality and integrity. The vulnerability impacts all versions up to 3.3.43 of the plugin. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with unsolicited links or requests that could trigger password resets. Monitoring official vendor channels for updates is recommended.