PT-2024-33469 · WordPress · Wp Rest Api Fns

Stealthcopter · Published 2024-10-20 · Updated 2025-01-11 · CVE-2024-49328

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP REST API FNS versions 1.0.0 and earlier

Description There is an Authentication Bypass Using an Alternate Path or Channel issue in WP REST API FNS, allowing users to bypass authentication. This lets users gain unauthorized access.

Recommendations For WP REST API FNS versions 1.0.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2024-49328

Affected Products

Wp Rest Api Fns

References · 17

• 🔥 https://github.com/RandomRobbieBF/CVE-2024-49328 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-49328 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49328 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1848007410780151989 · Twitter Post
• https://twitter.com/ShaiiikShoaiiib/status/1854692662890148168 · Twitter Post
• https://twitter.com/ksg93rd/status/1854567579622236400 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/rest-api-fns/vulnerability/wordpress-wp-rest-api-fns-plugin-plugin-1-0-0-account-takeover-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1847915944468775271 · Twitter Post
• https://t.me/latest_high_impact_cve/1365 · Telegram Post
• https://t.me/cvenotify/98881 · Telegram Post
• https://t.me/cybersecuritytechnologies/11404 · Telegram Post
• https://t.me/cvedetector/8396 · Telegram Post
• https://patchstack.com/database/vulnerability/rest-api-fns/wordpress-wp-rest-api-fns-plugin-plugin-1-0-0-account-takeover-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1847918919706620176 · Twitter Post
• https://t.me/cvenotify/99241 · Telegram Post