CVE-2024-12295
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Mar 19, 2025
CWE ID 640
Summary
CVE-2024-12295: The BoomBox Theme Extensions plugin for WordPress, affecting versions up to 1.8.0, contains a privilege escalation vulnerability. Attackers with subscriber-level access or higher can manipulate the 'boombox_ajax_reset_password' function without proper user identity validation, enabling them to change arbitrary user's passwords, including those of administrators. This vulnerability serves as an entry point for account takeovers.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.