Authentication Bypass Vulnerability Affects Rover IDX Plugin for WordPress
CVE-2024-10002
8.8HIGH
Summary
The Rover IDX plugin for WordPress is susceptible to an Authentication Bypass due to inadequate validation and capability checks in the 'rover_idx_refresh_social_callback' function. Attackers with subscriber-level permissions or higher can exploit this vulnerability to gain unauthorized administrative access. Although a partial patch is available in version 3.0.0.2905, users are strongly advised to upgrade to version 3.0.0.2906 to fully mitigate the risk. Ensuring the plugin is up to date is critical to maintaining the security of WordPress installations.
Affected Version(s)
Rover IDX * <= 3.0.0.2905
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
István Márton