CVE-2024-22144CWE-94

WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.21.96 - Unauthenticated Predictable Nonce Brute-Force Leading to RCE vulnerability

Critical · published April 25, 2024

CVSS v3.1
9.0
EPSS
1%
Percentile
58.4
In the wild
Unconfirmed
What it is

🚨 A code injection vulnerability in Eli Scheetz Anti-Malware Security and Brute-Force Firewall could let attackers run any code they want—no magic wand required! 🔥 Think of it as a restaurant where anyone can slip in a secret ingredient into the chef's recipes, potentially ruining every dish that comes out—yikes! An attacker could exploit this vulnerability to execute arbitrary code, which could lead to full control over the server. This means they could steal sensitive data, manipulate your security settings, or even deploy malicious software. It's absolutely devastating for anyone reliant on this firewall for protection!

Put simply

Think of it as a restaurant where anyone can slip in a secret ingredient into the chef's recipes, potentially ruining every dish that comes out—yikes! This vulnerability allows for improper control of code generation, enabling attackers to inject malicious code into the system. This issue affects versions of Anti-Malware Security and Brute-Force Firewall from n/a through 4.21.96—so if you're using this software, you're at risk!

What to do

An attacker could exploit this vulnerability to execute arbitrary code, which could lead to full control over the server. This means they could steal sensitive data, manipulate your security settings, or even deploy malicious software. It's absolutely devastating for anyone reliant on this firewall for protection! Update to the latest version immediately to patch this vulnerability. Regularly review your firewall settings and consider implementing additional security measures, such as intrusion detection systems, to monitor for suspicious activity. Don't forget to back up your data! You've got this! Follow these steps and you'll bolster your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00869 · 58.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-04-25T08:25Z
EPSS history
Timeline
  • 25 APR 08:25Z
    WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.21.96 - Unauthenticated Predictable Nonce Brute-Force Leading to RCE vulnerability
    cvelistv5