CVE-2024-9988

🗓️ 29 Oct 2024 16:31:29Reported by WordfenceType

The WordPress Crypto plugin (up to version 2.15) allows unauthenticated attackers to bypass authentication and log in as any existing user, including administrators, due to missing validation on the 'crypto_connect_ajax_process::register' function

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-9988	29 Oct 202418:57	–	circl
CNNVD	WordPress plugin Crypto 安全漏洞	29 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-9988 Crypto <= 2.19 - Authentication Bypass via register	29 Oct 202416:31	–	cvelist
EUVD	EUVD-2024-50267	29 Oct 202416:31	–	euvd
NVD	CVE-2024-9988	29 Oct 202417:15	–	nvd
Patchstack	WordPress Crypto plugin <= 2.18 - Authentication Bypass via register vulnerability	29 Oct 202407:55	–	patchstack
Patchstack	WordPress Crypto Plugin <= 2.18 is vulnerable to Broken Authentication	29 Oct 202400:00	–	patchstack
Positive Technologies	PT-2024-39985	29 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9988	5 Feb 202504:27	–	redhatcve
Vulnrichment	CVE-2024-9988 Crypto <= 2.19 - Authentication Bypass via register	29 Oct 202416:31	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

odude crypto_toolRange≤2.15wordpress

[
  {
    "vendor": "odude",
    "product": "Crypto Tool",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.19",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/crypto/tags/2.10/includes/class-crypto_connect_ajax_register.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/7bfe87cf-9883-4f8f-a0f5-23bbc7bb9b7c
plugins	www.plugins.trac.wordpress.org/changeset/3195424/crypto

08 Apr 2026 18:23Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.8

EPSS0.14779

SSVC

CWE-288