UltimateAI Plugin Vulnerable to Authentication Bypass
CVE-2024-9104
5.6MEDIUM
Key Information
- Vendor
- Tophive
- Status
- Ultimate Ai
- Vendor
- CVE Published:
- 16 October 2024
Summary
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimate_ai_change_pass' function. This makes it possible for unauthenticated attackers to reset the password of the first user, whose account is not yet activated or the first user who activated their account, who are subscribers.
Affected Version(s)
Ultimate AI <= 2.8.3
CVSS V3.1
Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published.
Disclosed
Vulnerability Reserved.
Discovered
Collectors
NVD DatabaseMitre Database
Credit
István Márton