Unauthorized Access to WordPress Sites via Hardcoded Encryption Key

CVE-2024-10284

Summary

The CE21 Suite plugin for WordPress has a vulnerability that allows unauthenticated attackers to bypass authentication mechanisms. This flaw arises from a hardcoded encryption key used in the 'ce21_authentication_phrase' function. As a result, any attacker with knowledge of the email address of an existing user, including administrators, can gain unauthorized access to their accounts. This vulnerability poses significant risks to website security, as it may lead to unauthorized actions taken on behalf of legitimate users.

References