WordPress ListApp Mobile Manager plugin <= 1.7.7 - Account Takeover vulnerability
CVE-2024-54295

9.8CRITICAL

Key Information:

Vendor
WordPress
Status
Listapp Mobile Manager
Vendor
CVE Published:
13 December 2024

Summary

A vulnerability exists in InspireUI's ListApp Mobile Manager that enables an authentication bypass through an alternate path or channel. This flaw affects versions from n/a up to 1.7.7, allowing unauthorized users to gain access to sensitive functionalities without proper authentication. Organizations using affected versions should prioritize patching to mitigate potential security threats and protect their user data.

Affected Version(s)

ListApp Mobile Manager <= 1.7.7

References

https://patchstack.com/database/wordpress/plugin/listapp-...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

stealthcopter (Patchstack Alliance)
.