PT-2025-1642 · WordPress · Adforest

Tonn · CVE-2024-11350 · Publicado 2025-01-08 · Atualizado 2025-08-12

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AdForest theme for WordPress versions up to and including 5.1.6

Description The issue arises from the plugin not properly validating a user's identity before updating their password through the adforest reset password() function. This allows unauthenticated attackers to change arbitrary users' passwords, including administrators, and gain access to their accounts.

Recommendations For versions up to and including 5.1.6, update to a version later than 5.1.6 to resolve the issue. As a temporary workaround, consider disabling the adforest reset password() function until a patch is available. Restrict access to the password reset functionality to minimize the risk of exploitation.

Correção

LPE

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2024-11350

Produtos afetados

Adforest

Referências · 10

• https://t.me/cvedetector/14676 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2024-11350 · Aviso do Fabricante
• https://t.me/cveNotify/131834 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1876953346117914840 · Publicação no Twitter
• https://t.me/cvenotify/106732 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/4ebb766a-44e9-460c-be84-356b7403e593?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-11350 · Nota de Segurança
• https://twitter.com/cracbot/status/1878683478180663625 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1876962096732066164 · Publicação no Twitter
• https://themeforest.net/item/adforest-classified-wordpress-theme/19481695 · Nota