Insecure Password Reset Vulnerability in Flight Plugin for WordPress

CVE-2024-9302

What is CVE-2024-9302?

The App Builder plugin for WordPress has an identified vulnerability that allows for privilege escalation through improper handling of OTP (One-Time Password) requests. This affects all versions of the plugin up to and including 5.3.7. The functions responsible for verifying OTPs and updating passwords lack sufficient security controls, which permits unauthenticated attackers to exploit these weaknesses. By brute forcing the OTP, an attacker can potentially gain access to any user's account, including those of administrators, and alter their passwords. This vulnerability spotlights the critical need for robust verification processes in password management functionalities to safeguard user accounts.

References