The IMITHEMES Listing plugin contains an unverified password change vulnerability (CWE-620) due to the imic_reset_password_init() function not properly validating the verification code before updating user passwords. This allows remote attackers to reset passwords of arbitrary users if they know the users' email addresses, leading to full account takeover and privilege escalation. The vulnerability affects all versions up to 3.3 and has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation results in complete account takeover of targeted users, including administrators, compromising the confidentiality, integrity, and availability of the affected system. Attackers can fully control user accounts, potentially leading to unauthorized access to sensitive data and administrative functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the password reset functionality if possible and monitor for suspicious password reset activities. Follow up with the vendor for updates and apply official patches immediately once released.