PT-2025-1642 · WordPress · Adforest

Tonn · Published 2025-01-08 · Updated 2025-08-12 · CVE-2024-11350

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AdForest theme for WordPress versions up to and including 5.1.6

Description The issue arises from the plugin not properly validating a user's identity before updating their password through the adforest reset password() function. This allows unauthenticated attackers to change arbitrary users' passwords, including administrators, and gain access to their accounts.

Recommendations For versions up to and including 5.1.6, update to a version later than 5.1.6 to resolve the issue. As a temporary workaround, consider disabling the adforest reset password() function until a patch is available. Restrict access to the password reset functionality to minimize the risk of exploitation.

Fix

LPE

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2024-11350

Affected Products

Adforest

References · 10

• https://osv.dev/vulnerability/CVE-2024-11350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11350 · Security Note
• https://t.me/cvedetector/14676 · Telegram Post
• https://t.me/cveNotify/131834 · Telegram Post
• https://twitter.com/CVEnew/status/1876953346117914840 · Twitter Post
• https://t.me/cvenotify/106732 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4ebb766a-44e9-460c-be84-356b7403e593?source=cve · Note
• https://twitter.com/cracbot/status/1878683478180663625 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1876962096732066164 · Twitter Post
• https://themeforest.net/item/adforest-classified-wordpress-theme/19481695 · Note