CVE-2024-9687

HIGH Year: 2024
CVSS v3 Score
8.8
High
Weakness Type
CWE-639
View all →

Vulnerability Description

The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.

Related Vulnerabilities

CVE-2014-8356

HIGH
CVSS:8.8(High)

The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct...

CWE-6392014

CVE-2017-3183

HIGH
CVSS:8.8(High)

Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Sage XRT Tre...

CWE-6392017

CVE-2018-16608

HIGH
CVSS:8.8(High)

In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&user_id=1, Insecure Direct Object Reference (IDOR).

CWE-6392018

CVE-2019-12742

HIGH
CVSS:8.8(High)

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object R...

CWE-6392019

CVE-2019-13605

HIGH
CVSS:8.8(High)

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker ...

CWE-6392019

CVE-2019-16403

HIGH
CVSS:8.8(High)

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.

CWE-6392019