CVE-2024-50489CWE-288

WordPress Realty Workstation plugin <= 1.0.45 - Account Takeover vulnerability

Critical · published October 28, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

🚨 An alternate path to bypass authentication is lurking in Realty Workstation. Imagine a sneaky side door that no one thought to lock! 🔥 Think of Realty Workstation like a hotel with a back entrance that isn't monitored — anyone can stroll right in without checking in. This vulnerability creates a similar situation where attackers can access sensitive areas without proper authentication checks. An attacker could exploit this vulnerability to gain unauthorized access, leading to absolute chaos! They could view, modify, or even delete sensitive data, all while keeping their identity hidden. The consequences could be devastating for any organization relying on this software.

Put simply

Think of Realty Workstation like a hotel with a back entrance that isn't monitored — anyone can stroll right in without checking in. This vulnerability creates a similar situation where attackers can access sensitive areas without proper authentication checks. This vulnerability allows attackers to bypass authentication by using an alternate path or channel, making it possible to access restricted areas of the Realty Workstation without the necessary credentials.

What to do

An attacker could exploit this vulnerability to gain unauthorized access, leading to absolute chaos! They could view, modify, or even delete sensitive data, all while keeping their identity hidden. The consequences could be devastating for any organization relying on this software. Immediately update Realty Workstation to version 1.0.46 or later to close this dangerous loophole. Review your security configurations to ensure no alternative access points are left unguarded. Regular audits will help fortify your defenses! You've got this! With a quick update and some vigilance, you can secure your systems in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00535 · 44.4th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2024-10-28T11:16Z
EPSS history
Timeline
  • 28 OCT 11:16Z
    WordPress Realty Workstation plugin <= 1.0.45 - Account Takeover vulnerability
    cvelistv5