WordPress WP Free SSL plugin <= 1.2.6 - Broken Access Control vulnerability
CVE-2024-44020

8.8HIGH

Key Information:

Vendor
Wordpress
Status
WP Free Ssl – Free Ssl Certificate For WordPress And Force Https
Vendor
CVE Published:
1 November 2024

Summary

A missing authorization vulnerability in the WP Free SSL – Free SSL Certificate for WordPress and force HTTPS plugin allows for unauthorized access to certain functionalities. This could potentially allow attackers to bypass intended security measures, leading to the exposure of sensitive data or unauthorized changes in configuration. The issue affects all versions up to and including 1.2.6, necessitating prompt action for securing WordPress installations that utilize this plugin.

Affected Version(s)

WP Free SSL – Free SSL Certificate for WordPress and force HTTPS <= 1.2.6

References

https://patchstack.com/database/vulnerability/wp-free-ssl...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdi Pranata (Patchstack Alliance)
.