CVEvulnerability

CVE-2024-9931

9.8 CRITICAL Published 2024-10-26 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2024-10-26
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-288

Description

The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on the token being supplied during the autologin through the plugin. This makes it possible for unauthenticated attackers to log in to the first administrator user.

Weakness · CWE (1)

CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References

https://plugins.trac.wordpress.org/browser/wux-blog-editor/tags/3.0.0/External_Post_Editor.php#L675 plugins.trac.wordpress.org
https://www.wordfence.com/threat-intel/vulnerabilities/id/494ef738-c900-4d00-8739-3b261586d4ff?source=cve www.wordfence.com

CVE-2024-9931

Description

Related

Weakness · CWE (1)

References