Unauthenticated SQL Injection Vulnerability Affects WordPress Users
CVE-2024-8911

9.8CRITICAL

Key Information:

Vendor

Wordpress
Status
Latepoint Plugin
Vendor
CVE Published:
8 October 2024

What is CVE-2024-8911?

The LatePoint plugin for WordPress features a security vulnerability due to improper handling of user input, leading to an SQL Injection flaw. This vulnerability allows malicious actors to change user passwords without authentication, particularly affecting WordPress users if the 'Use WordPress users as customers' setting is enabled. When this setting is configured, attackers could manipulate the SQL queries, resulting in unauthorized access to user accounts, including potential control over administrator credentials. The risk emphasizes the importance of securing plugin settings and ensuring timely updates to maintain website integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

LatePoint Plugin * <= 5.0.11

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wpdocs.latepoint.com/changelog/

EPSS Score

24% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

István Márton
JSON
.