PT-2025-9157 · WordPress · Exertio Framework

Foxyyy + 1 · Published 2025-03-01 · Updated 2025-03-06 · CVE-2024-13373

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Exertio Framework plugin for WordPress versions prior to 1.3.2

Description The issue allows for privilege escalation via account takeover due to improper validation of a user's identity before updating their password through the fl forgot pass new() function. This enables unauthenticated attackers to change arbitrary users' passwords, including administrators, and gain access to their accounts.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider disabling the fl forgot pass new() function until a patch is available. Restrict access to password update functionality to minimize the risk of exploitation.

Fix

LPE

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2024-13373

Affected Products

Exertio Framework

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-13373 · Security Note
• https://t.me/cvenotify/112970 · Telegram Post
• https://t.me/cvedetector/19225 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/897ce9a9-8b3e-40bc-9815-c55cc7a838f9?source=cve · Note
• https://twitter.com/CVEnew/status/1895981998583546329 · Twitter Post
• https://twitter.com/vulns_space/status/1895742409146819029 · Twitter Post
• https://twitter.com/cracbot/status/1897603142319231409 · Twitter Post
• https://twitter.com/cybercronai/status/1896119619653378325 · Twitter Post
• https://themeforest.net/item/exertio-freelance-marketplace-wordpress-theme/30602587 · Note
• https://twitter.com/VulmonFeeds/status/1895746508202360932 · Twitter Post