Authentication Bypass Vulnerability Affects Rover IDX Plugin for WordPress
CVE-2024-10002

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Vendor
CVE Published:
22 October 2024

Summary

The Rover IDX plugin for WordPress is susceptible to an Authentication Bypass due to inadequate validation and capability checks in the 'rover_idx_refresh_social_callback' function. Attackers with subscriber-level permissions or higher can exploit this vulnerability to gain unauthorized administrative access. Although a partial patch is available in version 3.0.0.2905, users are strongly advised to upgrade to version 3.0.0.2906 to fully mitigate the risk. Ensuring the plugin is up to date is critical to maintaining the security of WordPress installations.

Affected Version(s)

Rover IDX * <= 3.0.0.2905

References

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

István Márton
.
🍪 This website uses cookies, like every other website on the internet 😕 By using our website, you consent to the use of cookies.