PT-2024-31918 · WordPress · Wordpress
Published
2024-01-05
·
Updated
2024-02-05
·
CVE-2024-46188
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
WordPress (affected versions not specified)
Description
A phishing scam is targeting WordPress websites, exploiting a fictitious vulnerability. The scam involves sending emails warning of a supposed vulnerability called "CVE-2024-46188 Patch" and attempting to trick site owners into installing a fraudulent plugin. This plugin does not come from the official WordPress plugin ecosystem and can install malware on the website, creating an admin account and emailing attacker details. The estimated number of potentially affected devices is not specified.
Recommendations
To resolve the issue, remove the fraudulent "CVE-2024-46188" plugin. After removal, check the Users/Admin listing for backdoor Admin accounts and delete them if found. Ensure the number of Admin accounts equals the listed accounts and verify that they are familiar to avoid any further issues. As a temporary workaround, consider restricting access to the website until the issue is fully resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wordpress