Overview
- Description
- The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due to missing validation on the user being supplied in the 'crypto_connect_ajax_process::register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Source
- security@wordfence.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
Weaknesses
- security@wordfence.com
- CWE-288
Social media
- Hype score
- Not currently trending
CVE-2024-9988 The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due to missing validation on the user being suppl… https://t.co/5aPsh475TP
@CVEnew
29 Oct 2024
180 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[CVE-2024-9988: CRITICAL] WordPress Crypto plugin up to v2.15 has an authentication bypass vulnerability, allowing unauthenticated users to log in as any existing user by manipulating the user supplied in 'crypto_...#cybersecurity,#vulnerability https://t.co/7ArDdqZdmL https://t.
@CveFindCom
29 Oct 2024
4 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:odude:crypto_tool:*:*:*:*:*:wordpress:*:*",
"vulnerable": true,
"matchCriteriaId": "AC837D4F-56E6-40B8-98B2-823CC7B065DE",
"versionEndIncluding": "2.15"
}
],
"operator": "OR"
}
]
}
]