CVE-2024-52475CWE-288

WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability

Critical · published November 28, 2024

CVSS v3.1
9.8
EPSS
2%
Percentile
79.3
In the wild
Unconfirmed
What it is

🚨 An authentication bypass is lurking in Wawp versions below 3.0.18, making it easier than you’d think for an attacker to wade right into your system! 🔥 Think of it like a hotel with a hidden side door that bypasses the lobby completely — anyone who knows about it can stroll in and access rooms without even checking in! 🏨 If exploited, an attacker could gain unauthorized access to your system, potentially leading to devastating data breaches, unauthorized actions, and a complete compromise of user accounts. This is a critical flaw that could disrupt operations and expose sensitive information—yikes!

Put simply

Think of it like a hotel with a hidden side door that bypasses the lobby completely — anyone who knows about it can stroll in and access rooms without even checking in! 🏨 The vulnerability in Wawp allows attackers to bypass authentication checks through alternate paths, meaning they can access restricted areas of the platform without valid credentials. This flaw impacts Wawp versions from n/a up to but not including 3.0.18.

What to do

If exploited, an attacker could gain unauthorized access to your system, potentially leading to devastating data breaches, unauthorized actions, and a complete compromise of user accounts. This is a critical flaw that could disrupt operations and expose sensitive information—yikes! Immediate action is essential: upgrade your Wawp platform to version 3.0.18 or later to patch this vulnerability. Audit your configurations to ensure no other alternate access paths exist and reinforce your authentication mechanisms. You've got this! With a quick upgrade, you'll be on your way to fortifying your defenses! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01877 · 79.3th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2024-11-28T10:34Z
EPSS history
Timeline
  • 28 NOV 10:34Z
    WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability
    cvelistv5