PT-2025-2140 · WordPress · Adifier System

Tonn · Published 2025-01-18 · Updated 2025-01-23 · CVE-2024-13375

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adifier System plugin for WordPress versions up to, and including, 3.1.7

Description The issue arises from the plugin's failure to properly validate a user's identity before updating their details, such as passwords, through the adifier recover() function. This makes it possible for unauthenticated attackers to change arbitrary users' passwords, including those of administrators, and gain access to their accounts.

Recommendations For Adifier System plugin for WordPress versions up to, and including, 3.1.7: Update to a version later than 3.1.7 to resolve the issue. As a temporary workaround, consider disabling the adifier recover() function until a patch is available. Restrict access to the plugin's user management features to minimize the risk of exploitation.

Exploit

Fix

LPE

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2024-13375

Affected Products

Adifier System

References · 10

• 🔥 https://github.com/McTavishSue/CVE-2024-13375 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-13375 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/fbf2aeed-0f18-4ef6-aff8-9e8c4531d789?source=cve · Note
• https://t.me/cvedetector/15799 · Telegram Post
• https://t.me/cvenotify/107864 · Telegram Post
• https://themeforest.net/item/adifier-classified-ads-wordpress-theme/21633950 · Note
• https://twitter.com/cracbot/status/1882411884575433210 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1880558002404577723 · Twitter Post
• https://twitter.com/CVEnew/status/1880625621866614980 · Twitter Post
• https://twitter.com/CveFindCom/status/1880533648908136593 · Twitter Post