PT-2024-39005 · WordPress · Forumwp
Wesley
·
Published
2024-09-06
·
Updated
2024-09-26
·
CVE-2024-8428
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
The ForumWP – Forum & Discussion Board Plugin plugin for WordPress versions up to, and including, 2.0.2
Description:
The issue is related to Privilege Escalation via Insecure Direct Object Reference. This is due to missing validation on the
user id user-controlled key in the submit form handler. Authenticated attackers with subscriber-level access and above can change the email address of administrative user accounts, potentially allowing them to reset the administrative users' password and gain access to their account.Recommendations:
For versions up to, and including, 2.0.2, consider disabling the
submit form handler function until a patch is available to prevent exploitation. Restrict access to administrative user accounts and monitor for any suspicious activity related to email address changes or password resets.Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Forumwp