PT-2024-39985 · WordPress · Crypto++

István Márton · Published 2024-10-29 · Updated 2026-04-08 · CVE-2024-9988

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crypto plugin for WordPress versions up to, and including, 2.15

Description The issue is related to authentication bypass due to missing validation on the user being supplied in the crypto connect ajax process::register function. This allows unauthenticated attackers to log in as any existing user, such as an administrator, if they have access to the username.

Recommendations For Crypto plugin for WordPress versions up to, and including, 2.15, update to a version that includes the necessary validation to prevent authentication bypass. As a temporary workaround, consider disabling the crypto connect ajax process::register function until a patch is available.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2024-9988

Affected Products

Crypto++

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-9988 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9988 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3195424/crypto#file3 · Note
• https://t.me/cvedetector/9345 · Telegram Post
• https://twitter.com/0dayPublishing/status/2041937635355074738 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7bfe87cf-9883-4f8f-a0f5-23bbc7bb9b7c?source=cve · Note
• https://t.me/cvenotify/100964 · Telegram Post
• https://plugins.trac.wordpress.org/browser/crypto/tags/2.10/includes/class-crypto_connect_ajax_register.php#L91 · Note