All the vulnerabilites related to scriptsbundle - AdForest
cve-2024-11349
Vulnerability from cvelistv5
Published
2024-12-21 04:22
Modified
2024-12-21 04:22
Severity ?
EPSS score ?
Summary
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the sb_login_user_with_otp_fun() function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.
References
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | scriptsbundle | AdForest |
Version: * ≤ 5.1.6 |
|
{ "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "AdForest", "vendor": "scriptsbundle", "versions": [ { "lessThanOrEqual": "5.1.6", "status": "affected", "version": "*", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Tonn" } ], "descriptions": [ { "lang": "en", "value": "The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user\u0027s identity prior to authenticating them through the sb_login_user_with_otp_fun() function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators." } ], "metrics": [ { "cvssV3_1": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-12-21T04:22:17.791Z", "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f374b3d1-820b-473f-8d2b-c3267e6d23d9?source=cve" }, { "url": "https://themeforest.net/item/adforest-classified-wordpress-theme/19481695" } ], "timeline": [ { "lang": "en", "time": "2024-12-20T00:00:00.000+00:00", "value": "Disclosed" } ], "title": "AdForest \u003c= 5.1.6 - Authentication Bypass" } }, "cveMetadata": { "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "assignerShortName": "Wordfence", "cveId": "CVE-2024-11349", "datePublished": "2024-12-21T04:22:17.791Z", "dateReserved": "2024-11-18T16:47:22.199Z", "dateUpdated": "2024-12-21T04:22:17.791Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }