The DWT - Directory & Listing WordPress Theme contains a vulnerability (CWE-620) where the dwt_listing_reset_password() function does not properly verify that the password reset token is non-empty before allowing a password reset. This flaw enables unauthenticated attackers to change any user's password, including those with administrative privileges, resulting in privilege escalation and account takeover. The vulnerability affects all versions up to and including 3.3.6 and has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can reset passwords for arbitrary users without authentication, including administrators, leading to full account compromise and control over the affected WordPress site. This compromises confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix links are provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the password reset functionality if possible or disable the vulnerable theme. Avoid using affected versions in production environments.