PT-2024-39865 · WordPress · Wp 2Fa With Telegram

István Márton · Published 2024-10-14 · Updated 2024-10-19 · CVE-2024-9820

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WP 2FA with Telegram plugin for WordPress versions up to, and including, 3.0

Description The issue is related to Two-Factor Authentication Bypass. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.

Recommendations For versions up to, and including, 3.0, consider disabling the two-factor authentication feature until a patch is available. Restrict access to sensitive areas of the WordPress site to minimize the risk of exploitation. Avoid relying solely on the two-factor authentication provided by the WP 2FA with Telegram plugin for security. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-565

CWE-784

Related Identifiers

CVE-2024-9820

Affected Products

Wp 2Fa With Telegram

References · 10

• https://osv.dev/vulnerability/CVE-2024-9820 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9820 · Security Note
• https://t.me/cvenotify/98833 · Telegram Post
• https://twitter.com/CVEnew/status/1846025107661377966 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ccd73030-7185-4302-b3fd-29cbbe716e3e?source=cve · Note
• https://t.me/cvedetector/7875 · Telegram Post
• https://t.me/cvenotify/98020 · Telegram Post
• https://plugins.trac.wordpress.org/browser/two-factor-login-telegram/tags/3.0/includes/class-wp-factor-telegram-plugin.php#L228 · Note
• https://twitter.com/cracbot/status/1847518141267738791 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1846076065111843163 · Twitter Post