CVE-2024-12860: CWE-620 Unverified Password Change in scriptsbundle CarSpot – Dealership Wordpress Classified Theme
The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
AI Analysis
Technical Summary
CVE-2024-12860 is a critical vulnerability (CVSS 9.8) in the CarSpot – Dealership Wordpress Classified Theme by scriptsbundle. The issue arises from improper validation of a token before updating a user's password, allowing unauthenticated attackers to arbitrarily change passwords of any user, including administrators. This vulnerability enables privilege escalation via account takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.
Potential Impact
Successful exploitation allows an unauthenticated attacker to change passwords of arbitrary users, including administrators, resulting in full account takeover. This leads to complete compromise of the affected WordPress site, impacting confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected theme and monitor for suspicious activity. Avoid using the vulnerable versions of the theme and consider disabling or replacing it if possible.
CVE-2024-12860: CWE-620 Unverified Password Change in scriptsbundle CarSpot – Dealership Wordpress Classified Theme
Description
The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-12860 is a critical vulnerability (CVSS 9.8) in the CarSpot – Dealership Wordpress Classified Theme by scriptsbundle. The issue arises from improper validation of a token before updating a user's password, allowing unauthenticated attackers to arbitrarily change passwords of any user, including administrators. This vulnerability enables privilege escalation via account takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.
Potential Impact
Successful exploitation allows an unauthenticated attacker to change passwords of arbitrary users, including administrators, resulting in full account takeover. This leads to complete compromise of the affected WordPress site, impacting confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected theme and monitor for suspicious activity. Avoid using the vulnerable versions of the theme and consider disabling or replacing it if possible.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-12-20T17:00:35.574Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6e4bb7ef31ef0b59c6f7
Added to database: 2/25/2026, 9:48:59 PM
Last enriched: 4/9/2026, 6:29:22 AM
Last updated: 4/13/2026, 5:01:43 AM
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.