Authenticatiom Bypass Vulnerability in ProfilePress Pro Plugin for WordPress

CVE-2024-9947

What is CVE-2024-9947?

The ProfilePress Pro plugin for WordPress exhibits a vulnerability that allows for authentication bypass, enabling unauthenticated attackers to gain access to any existing user account, including those with administrative privileges. This security issue arises from inadequate verification processes associated with the social login tokens used within the plugin. If an attacker possesses the email of a user who has not previously created an account for the social login service that issues the token, they can exploit this flaw to log in as that user. This presents a significant risk to websites utilizing the affected plugin versions, as it compromises account security and potentially exposes sensitive site operations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References