Authentication Bypass Vulnerability Affects Rover IDX Plugin for WordPress

CVE-2024-10002

What is CVE-2024-10002?

The Rover IDX plugin for WordPress is susceptible to an Authentication Bypass due to inadequate validation and capability checks in the 'rover_idx_refresh_social_callback' function. Attackers with subscriber-level permissions or higher can exploit this vulnerability to gain unauthorized administrative access. Although a partial patch is available in version 3.0.0.2905, users are strongly advised to upgrade to version 3.0.0.2906 to fully mitigate the risk. Ensuring the plugin is up to date is critical to maintaining the security of WordPress installations.

References