PT-2024-33385 · WordPress · Buddypress Better Registration

Stealthcopter · Published 2024-10-16 · Updated 2024-10-16 · CVE-2024-49247

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BuddyPress Better Registration versions 1.6 and earlier BuddyPress Better Registration version 1.7 is not affected, as it contains the fix for the issue.

Description The issue is an Authentication Bypass Using an Alternate Path or Channel vulnerability, which allows attackers to bypass authentication. This flaw is present in the BuddyPress Better Registration plugin.

Recommendations For BuddyPress Better Registration versions 1.6 and earlier: Update to version 1.7 to fix this issue. As a temporary workaround, consider restricting access to sensitive areas of the plugin until the update is applied.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2024-49247

Affected Products

Buddypress Better Registration

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-49247 · Security Note
• https://twitter.com/asdfg12346782/status/1846544128743502099 · Twitter Post
• https://twitter.com/CVEnew/status/1846537264584642593 · Twitter Post
• https://t.me/latest_high_impact_cve/1340 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/better-bp-registration/vulnerability/wordpress-buddypress-better-registration-plugin-1-6-broken-authentication-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/8053 · Telegram Post
• https://twitter.com/CveFindCom/status/1846537124142621018 · Twitter Post
• https://patchstack.com/database/vulnerability/better-bp-registration/wordpress-buddypress-better-registration-plugin-1-6-broken-authentication-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1846588318126911670 · Twitter Post