CVE-2024-12771 Overview
CVE-2024-12771 is a Cross-Site Request Forgery (CSRF) vulnerability in the eCommerce Product Catalog Plugin for WordPress. The flaw affects all versions up to and including 3.3.43. The root cause is missing or incorrect nonce validation on the customer_panel_password_reset function. Unauthenticated attackers can reset the password of any administrator or customer account by tricking a site administrator into clicking a crafted link. The vulnerability maps to [CWE-352] and has a network attack vector with user interaction required.
Critical Impact
Successful exploitation lets an attacker take over any administrator account on a vulnerable WordPress site, leading to full site compromise.
Affected Products
- eCommerce Product Catalog Plugin for WordPress, versions up to and including 3.3.43
- WordPress sites using the vulnerable customer-panel.php module
- Any administrator or customer account managed by the plugin
Discovery Timeline
- 2024-12-21 - CVE-2024-12771 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-12771
Vulnerability Analysis
The vulnerability resides in the customer panel password reset flow of the eCommerce Product Catalog Plugin. The customer_panel_password_reset function processes password reset requests without verifying a valid WordPress nonce. WordPress relies on nonces to confirm that a state-changing request originated from an authorized user session. When nonce validation is missing or incorrect, the application cannot distinguish between a legitimate administrator action and a forged request submitted via a malicious page. An attacker hosts a crafted form or link that submits a password reset for a target account when an authenticated administrator visits the attacker-controlled page. The browser automatically attaches the administrator's session cookies, and the server processes the forged request as if the administrator initiated it.
Root Cause
The root cause is the absence or incorrect implementation of nonce validation in the customer_panel_password_reset function within modules/cart/includes/customers/includes/transactions/customer-panel.php. The vendor fix is recorded in the WordPress Changeset Log, and the vulnerable code locations are documented in the WordPress Plugin Code Review.
Attack Vector
An attacker crafts an HTML page containing a form or image tag that submits a password reset request to the target WordPress site. The attacker then lures an authenticated administrator to the page through phishing, a forum comment, or a malicious advertisement. When the administrator's browser submits the request, the server resets the targeted account's password to a value the attacker controls. The attacker subsequently logs in as the compromised administrator or customer.
No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-12771
Indicators of Compromise
- Unexpected password reset events for administrator or customer accounts in WordPress logs
- HTTP POST requests targeting the customer_panel_password_reset action without a valid Referer matching the site origin
- New or modified administrator sessions originating from unfamiliar IP addresses shortly after a password reset
- Outbound requests from administrator browsers to untrusted domains immediately preceding account changes
Detection Strategies
- Audit WordPress activity logs for password reset events that lack a corresponding user-initiated workflow
- Inspect web server access logs for POST requests to the plugin's customer panel endpoints with missing or invalid nonce parameters
- Correlate administrator browsing activity with subsequent account changes to identify CSRF chains
Monitoring Recommendations
- Enable verbose logging on the WordPress admin and customer panel endpoints exposed by the plugin
- Alert on password reset events for privileged accounts outside expected change windows
- Monitor for repeated failed nonce validations after applying the patch to identify probing activity
How to Mitigate CVE-2024-12771
Immediate Actions Required
- Update the eCommerce Product Catalog Plugin for WordPress to a version above 3.3.43 that includes the fix from changeset 3210939
- Force a password reset for all administrator and customer accounts managed by the plugin
- Invalidate active WordPress sessions for privileged users to evict any attacker who may have already gained access
- Review the WordPress user roster for unauthorized accounts or recent role changes
Patch Information
The vendor addressed the CSRF flaw in the commit recorded at the WordPress Changeset Log. The fix adds nonce validation to the customer_panel_password_reset function. Administrators should upgrade through the WordPress plugin updater or by deploying the patched plugin package.
Workarounds
- Disable the eCommerce Product Catalog Plugin until the patched version can be installed
- Restrict access to the WordPress admin interface using IP allowlists or VPN-only access to reduce CSRF exposure
- Train administrators to avoid clicking untrusted links while authenticated to the WordPress dashboard
- Deploy a web application firewall rule that blocks requests to the plugin's password reset endpoint when no valid nonce parameter is present
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
