PT-2025-18042 · WordPress · Admin/Site Enhancements (Ase) Wordpress Plugin

Dogus Demirkiran · Published 2025-04-28 · Updated 2025-04-28 · CVE-2024-13688

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Admin and Site Enhancements (ASE) WordPress plugin versions prior to 7.6.10

Description The issue concerns the use of a hardcoded password in the Password Protection feature of the Admin and Site Enhancements (ASE) WordPress plugin. This allows an attacker to bypass the protection offered by the plugin via a crafted request.

Recommendations For versions prior to 7.6.10, update to version 7.6.10 or later to resolve the issue. As a temporary workaround, consider disabling the Password Protection feature until a patch is available. Restrict access to the Password Protection module to minimize the risk of exploitation. Avoid using the hardcoded password in the affected feature until the issue is resolved.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-13688

Affected Products

Admin/Site Enhancements (Ase) Wordpress Plugin

References · 7

• 🔥 https://wpscan.com/vulnerability/19051d08-16b0-466c-976b-be7b076e8e92 · Exploit
• https://osv.dev/vulnerability/CVE-2024-13688 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13688 · Security Note
• https://twitter.com/CVEnew/status/1916741404661088361 · Twitter Post
• https://t.me/cvenotify/119998 · Telegram Post
• https://t.me/cvedetector/23887 · Telegram Post
• https://t.me/cvetracker/22500 · Telegram Post