CVE-2024-2172

🗓️ 13 Mar 2024 15:26:53Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 99 Views🌐 WEB

The Malware Scanner plugin and the Web Application Firewall plugin for WordPress by MiniOrange are vulnerable to privilege escalation up to versions 4.7.2 and 2.1.1 respectively

Reporter	Title	Published	Views	Family All 18
Circl	CVE-2024-2172	18 Mar 202410:59	–	circl
CNNVD	WordPress Plugin Malware Scanner Security Vulnerability	13 Mar 202400:00	–	cnnvd
Cvelist	CVE-2024-2172 Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation	13 Mar 202415:26	–	cvelist
EUVD	EUVD-2024-27135	3 Oct 202520:07	–	euvd
hivepro	Critical Flaw In WordPress Plugins Poses Risk Of Site Takeover	21 Mar 202405:46	–	hivepro
NVD	CVE-2024-2172	13 Mar 202416:15	–	nvd
Patchstack	WordPress Web Application Firewall – website security Plugin <= 2.1.1 is vulnerable to Privilege Escalation	13 Mar 202400:00	–	patchstack
Patchstack	WordPress Malware Scanner Plugin <= 4.7.2 is vulnerable to Privilege Escalation	13 Mar 202400:00	–	patchstack
Prion	Privilege escalation	13 Mar 202416:15	–	prion
Positive Technologies	PT-2024-19020 · WordPress · Web Application Firewall +1	13 Mar 202400:00	–	ptsecurity

Vulners

Vulnrichment

Node

imperva web_application_firewallRange≤2.1.1wordpress

miniorange malware_scannerRange≤4.7.2wordpress

[
  {
    "vendor": "cyberlord92",
    "product": "Web Application Firewall – website security",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.1.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "cyberlord92",
    "product": "Malware Scanner",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.7.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/6347f588-a3fd-4909-ad57-9d78787b5728
plugins	www.plugins.trac.wordpress.org/browser/miniorange-malware-protection/tags/4.7.2/handler/login.php
plugins	www.plugins.trac.wordpress.org/changeset
wordpress	www.wordpress.org/plugins/miniorange-malware-protection/
plugins	www.plugins.trac.wordpress.org/changeset

Parameter	Position	Path	Description	CWE
option	request body	/wp-login.php	Unauthenticated attacker can reset an administrator password via mo_wpns_change_password option on wp-login.php.	CWE-304
username	request body	/wp-login.php	Unauthenticated attacker can reset an administrator password via mo_wpns_change_password option on wp-login.php.	CWE-304
new_password	request body	/wp-login.php	Unauthenticated attacker can reset an administrator password via mo_wpns_change_password option on wp-login.php.	CWE-304
confirm_password	request body	/wp-login.php	Unauthenticated attacker can reset an administrator password via mo_wpns_change_password option on wp-login.php.	CWE-304

17 Jun 2026 07:23Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.01712

SSVC

CWE-304