Paper/Archive/CVE-2024-9862

CVE-2024-9862

cyberlord92 Miniorange OTP Verification with Firebase — Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 48.8.488 × 209.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.

Affected

ProductAffectedFixed inSource

Miniorange OTP Verification with Firebase≤ 3.6.0–CNA

otp_verification≤ 3.6.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/9c3df12d-e526-4a23-89d3-bfdcea9f7b2d?source=cve refplugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-loginform.php#L236 refplugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otp-verification#file3