PT-2024-39986 · WordPress · Crypto++
István Márton
·
Published
2024-10-29
·
Updated
2026-04-08
·
CVE-2024-9989
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Crypto plugin for WordPress versions up to, and including, 2.15
Description
The issue is related to authentication bypass. This is due to a limited arbitrary method call to
crypto connect ajax process::log in function in the crypto connect ajax process function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.Recommendations
For Crypto plugin for WordPress versions up to, and including, 2.15, consider disabling the
crypto connect ajax process function until a patch is available. Restrict access to the crypto connect ajax process::log in function to minimize the risk of exploitation. Avoid using the username variable in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Authentication Bypass Using an Alternate Path or Channel
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Crypto++