CVE-2024-50477CWE-288

WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability

Critical · published October 28, 2024

CVSS v3.1
9.8
EPSS
8%
Percentile
94.8
In the wild
Unconfirmed
What it is

🚨 An authentication bypass in the Stacks Mobile App Builder could let anyone waltz through your gates! Think of it like a hotel with a side entrance that doesn't check IDs — anyone sneaky enough can slip right in without a reservation! 📋 The implications are absolutely devastating: an attacker could gain unauthorized access to accounts, read sensitive data, or even manipulate user settings. This is a goldmine for anyone looking to wreak havoc without ever needing to show their credentials! ⚡

Put simply

Think of it like a hotel with a side entrance that doesn't check IDs — anyone sneaky enough can slip right in without a reservation! 📋 This vulnerability allows attackers to bypass authentication using alternate channels, meaning they can gain access without valid login credentials. The flaw exists in Stacks Mobile App Builder versions up to 5.2.3, making it a critical concern for users.

What to do

The implications are absolutely devastating: an attacker could gain unauthorized access to accounts, read sensitive data, or even manipulate user settings. This is a goldmine for anyone looking to wreak havoc without ever needing to show their credentials! ⚡ Patch immediately to version 5.2.4 or later to close this vulnerability. Implement strict access controls and perform routine security audits on your application to ensure no alternate paths are left unmonitored. 🛡️ You’ve got this! By staying proactive and following these steps, you can lock down your application and keep your users safe! 🔒

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.08118 · 94.8th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2024-10-28T11:23Z
EPSS history
Timeline
  • 28 OCT 11:23Z
    WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability
    cvelistv5