Paper/Archive/CVE-2024-9289

CVE-2024-9289

RedefiningTheWeb WordPress & WooCommerce Affiliate Program — WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 47.7.477 × 209.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwap_login_request_callback() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's email.

Affected

ProductAffectedFixed inSource

WordPress & WooCommerce Affiliate Program≤ 8.4.1–CNA

affiliate_pro≤ 8.4.1–CISA-ADP

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/ed19835f-2718-41d8-95af-47c8b9589529?source=cve refcodecanyon.net/item/wordpress-woocommerce-affiliate-program/23580333