CVE-2024-9687

The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validatetg' action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-9687 WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass

The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validatetg' action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-9687 WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass

The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validatetg' action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-9687

The CVE-2024-9687 vulnerability affects WP 2FA with Telegram for WordPress in versions up to 3.0. Root cause: insufficient validation of the user-controlled key on the validate_tg action, enabling authentication bypass for authenticated users with subscriber-level permissions and above to log in ...

WordPress Edwiser Bridge Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

Software Edwiser Bridge Type Plugin Vulnerable versions = 3.0.7 Fixed in 3.0.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49311 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 21963ed8844c Credits Muhammad Daffa Required privilege...

PT-2024-15274 · WordPress · The Paytium: Mollie Payment Forms & Donations

Name of the Vulnerable Software and Affected Versions: The Paytium: Mollie payment forms & donations plugin for WordPress versions up to, and including, 4.3.7 Description: The issue allows unauthorized access to data due to a missing capability check on the check mollie account details function...

WordPress WP 2FA with Telegram Plugin <= 3.0 is vulnerable to Bypass Vulnerability

Software WP 2FA with Telegram Type Plugin Vulnerable versions = 3.0 Fixed in 3.1 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-9820 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID ed4d0a1bac8d Credits István Márton Required privilege...

WordPress Edwiser Bridge Plugin <= 3.0.7 is vulnerable to Server Side Request Forgery (SSRF)

Software Edwiser Bridge Type Plugin Vulnerable versions = 3.0.7 Fixed in 3.0.8 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-49312 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID b179ae0d4ea9 Credits Muhamma...

PT-2024-15271 · WordPress · The Paytium: Mollie Payment Forms & Donations

Name of the Vulnerable Software and Affected Versions: The Paytium: Mollie payment forms & donations plugin for WordPress versions up to, and including, 4.3.7 Description: The issue is related to unauthorized access of data due to a missing capability check on the check for verified profiles...

PT-2024-10844 · WordPress · Discount Rules For Woocommerce

Name of the Vulnerable Software and Affected Versions: Discount Rules for WooCommerce plugin for WordPress versions up to, and including, 2.0.2 Description: The issue is related to missing authorization via several AJAX actions due to missing capability checks on various functions. This allows...

WordPress WP 2FA with Telegram Plugin <= 3.0 is vulnerable to Broken Authentication

Software WP 2FA with Telegram Type Plugin Vulnerable versions = 3.0 Fixed in 3.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9687 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID c6f09889bfbf Credits István...

PT-2024-15272 · WordPress · The Paytium: Mollie Payment Forms & Donations

Name of the Vulnerable Software and Affected Versions: The Paytium: Mollie payment forms & donations plugin for WordPress versions up to, and including, 4.3.7 Description: The issue allows unauthorized modification of data due to a missing capability check on the create mollie account function...

PT-2024-11043 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to and including 4.6.4 Description: The issue is related to authorization bypass due to missing capability checks and nonce disclosure. This allows authenticated attackers wi...

PT-2024-15275 · WordPress · The Paytium: Mollie Payment Forms & Donations

Name of the Vulnerable Software and Affected Versions: The Paytium: Mollie payment forms & donations plugin for WordPress versions up to, and including, 4.3.7 Description: The issue is related to unauthorized data modification due to a missing capability check on the create mollie profile functio...

PT-2024-39917 · WordPress · Multiline Files Upload For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Multiline files upload for contact form 7 plugin for WordPress versions up to, and including, 2.8.1 Description: The issue is related to a missing capability check on the mfcf7 zl custom handle deactivation plugin form submission function. Th...

WordPress Order Attachments for WooCommerce plugin 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload vulnerability

WordPress Order Attachments for WooCommerce plugin 2.0 - 2.4.1 - Missing Authorization to Authenticated Subscriber+ Limited Arbitrary File Upload vulnerability discovered by luckynoob in WordPress Plugin Order Attachments for WooCommerce versions 2.0 - 2.4.1...

WordPress Read more By Adam plugin <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Read More Button Deletion vulnerability discovered by Francesco Carlucci in WordPress Plugin Read more By Adam versions = 1.1.8...

WordPress Jetpack Plugin < 13.9.1 is vulnerable to Broken Access Control

Software Jetpack Type Plugin Vulnerable versions 13.9.1 Fixed in 13.9.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9926 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 675e1d99d774 Credits Marc Montpas Required privilege...

WordPress Free Stock Photos Foter Plugin <= 1.5.4 is vulnerable to PHP Object Injection

Software Free Stock Photos Foter Type Plugin Vulnerable versions = 1.5.4 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-49227 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 0e6ee5afeccb Credits LVT-tholv2k Required privilege...

WordPress WordPress Gallery Plugin – Limb Image Gallery Plugin <= 1.5.7 is vulnerable to Arbitrary File Download

Software WordPress Gallery Plugin – Limb Image Gallery Type Plugin Vulnerable versions = 1.5.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Download CVE CVE-2024-49258 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID f9ffdc125499 Credits...