PT-2024-37804 · WordPress · Wordpress Plugin

John Castro · Published 2024-07-16 · Updated 2024-08-21 · CVE-2024-6695

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Popular WordPress Plugin (affected versions not specified)

Description The issue allows an attacker to gain administrative access without having an account on the targeted site, enabling them to perform unauthorized actions. This is caused by improper logic flow in the user registration process. It's estimated that around 50,000 sites are exposed to this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-6695

Affected Products

Wordpress Plugin

References · 7

• 🔥 https://wpscan.com/vulnerability/4afa5c85-ce27-4ca7-bba2-61fb39c53a5b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6695 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6695 · Vendor Advisory
• https://twitter.com/Komodosec/status/1826439282573410451 · Twitter Post
• https://t.me/cvenotify/88009 · Telegram Post
• https://t.me/cvedetector/2108 · Telegram Post
• https://t.me/pentestingnews/49164 · Telegram Post