Podatność CVE-2024-9822
Publikacja: 2024-10-11

Opis:
The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'login_admin_user' function. This makes it possible for unauthenticated attackers to log to the first user, who is usually the administrator, or if it does not exist, then to the first administrator.

Typ:

CWE-288

 (Authentication Bypass Using an Alternate Path or Channel)

 Referencje:
https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab0d342-bfa7-4760-b839-37c3354414ca?source=cve
https://plugins.trac.wordpress.org/browser/pedalo-connector/tags/2.0.5/public/class-pedalo_connector-public.php#L118
Copyright 2024, cxsecurity.com

 

Back to Top