Unauthenticated Attackers Can Change Admin Passwords via Plugin Vulnerability
CVE-2024-9862
9.8CRITICAL
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 17 October 2024
What is CVE-2024-9862?
The MiniOrange OTP Verification with Firebase plugin for WordPress contains a vulnerability that allows for arbitrary user password changes. In versions up to and including 3.6.0, the plugin fails to adequately restrict user access to system resources, permitting unauthorized users to bypass essential authorization checks. This issue arises from the absence of a verification step for the user's current password, opening the door for unauthenticated attackers to alter the passwords of existing accounts, including those of administrators, thereby posing significant risks to system security and user data integrity.
Affected Version(s)
Miniorange OTP Verification with Firebase * <= 3.6.0