Authentication Bypass Vulnerability in WP 2FA with Telegram Plugin

CVE-2024-9687

What is CVE-2024-9687?

The WP 2FA with Telegram plugin for WordPress, specifically in versions up to and including 3.0, is affected by an authentication bypass vulnerability. This arises from inadequate validation of a user-controlled key during the 'validate_tg' action. As a result, authenticated attackers with at least subscriber-level permissions can exploit this flaw to gain unauthorized access, potentially allowing them to log in as any existing user on the site, including administrators, thereby compromising the integrity and security of the affected WordPress installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References