Authentication Bypass Vulnerability in AdForest Theme for WordPress
CVE-2024-11349

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Adforest
Vendor
CVE Published:
21 December 2024

Summary

CVE-2024-11349 identifies a critical security vulnerability in the AdForest theme for WordPress, allowing unauthenticated attackers to bypass authentication mechanisms. This flaw exists in all versions up to and including 5.1.6, stemming from insufficient user identity verification during the login process handled by the sb_login_user_with_otp_fun() function. Attackers can exploit this vulnerability to gain unauthorized access to arbitrary user accounts, including those of administrators, potentially compromising sensitive site data and user privacy.

Affected Version(s)

AdForest * <= 5.1.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://themeforest.net/item/adforest-classified-wordpres...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tonn
.