CVE-2024-43311CWE-269

WordPress Login As Users plugin <= 1.4.2 - Broken Authentication vulnerability

Critical · published August 19, 2024

CVSS v3.1
9.8
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

🚨 A sneaky privilege escalation vulnerability in Geek Code Lab could let attackers leap into roles they don’t own! 🔥 Think of it like a guest slipping into the VIP section at a concert without a ticket — once in, they can access everything the VIPs enjoy, causing chaos! 🎤 An attacker could gain unauthorized access and perform actions beyond their intended permissions, potentially compromising sensitive data or executing harmful commands. It's an absolute disaster waiting to happen, with the potential to bring your system to its knees!

Put simply

Think of it like a guest slipping into the VIP section at a concert without a ticket — once in, they can access everything the VIPs enjoy, causing chaos! 🎤 This improper privilege management vulnerability allows users to escalate their privileges through the Login As Users feature, potentially accessing restricted areas of the application.

What to do

An attacker could gain unauthorized access and perform actions beyond their intended permissions, potentially compromising sensitive data or executing harmful commands. It's an absolute disaster waiting to happen, with the potential to bring your system to its knees! Upgrade to at least version 1.4.3 to patch this vulnerability immediately. Ensure that proper role checks are implemented consistently across the application to prevent unauthorized access. Don't wait—protect your system today! You’ve got this! Fix it now, and you’ll secure your app like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00473 · 40.0th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-08-19T19:20Z
EPSS history
Timeline
  • 19 AUG 19:20Z
    WordPress Login As Users plugin <= 1.4.2 - Broken Authentication vulnerability
    cvelistv5