The IMITHEMES Listing plugin fails to validate a verification code when resetting passwords, allowing an unauthenticated attacker to change any user’s password if the user’s email address is known. The consequence is full control over that user’s account, including administrator accounts, thereby compromising confidentiality, integrity, and availability of the WordPress site. This weakness is categorized as CWE-620.

The vulnerability affects all releases of the IMITHEMES Listing plugin up to and including version 3.3. Only users installing these versions are at risk; newer releases are presumed to have addressed the flaw.

The flaw carries a CVSS score of 9.8, indicating a high severity impact. The EPSS score is less than 1%, suggesting exploitation is not widespread but still possible. The vulnerability is not listed in CISA’s KEV catalog. An attacker can simply send a password reset request to the plugin’s endpoint with a known user email, bypass authentication, and set a new password, then use the account to further compromise the site. No special privileges or network access are required beyond the ability to send HTTP requests to the server.