Critical · published June 20, 2024
🚨 An unauthenticated attacker can waltz right in and log in as any user, including site admins, with just a valid email address! 🔥 This vulnerability is like a thief who knows your email and can simply walk through the front door of your house because no one checked their ID at the entrance. Without proper verification, it’s an open invite for anyone with the right email to take over your site! If exploited, this critical flaw could allow attackers to gain full administrative access, potentially leading to malicious activities like data theft, site defacement, or unauthorized changes to donations. The consequences could be absolutely devastating for both your organization and the trust of your users!
This vulnerability is like a thief who knows your email and can simply walk through the front door of your house because no one checked their ID at the entrance. Without proper verification, it’s an open invite for anyone with the right email to take over your site! The Lifeline Donation plugin for WordPress suffers from an authentication bypass due to insufficient verification of the user during checkout, enabling attackers to impersonate any existing user if they know the email address registered on the site.
If exploited, this critical flaw could allow attackers to gain full administrative access, potentially leading to malicious activities like data theft, site defacement, or unauthorized changes to donations. The consequences could be absolutely devastating for both your organization and the trust of your users! Immediately update the Lifeline Donation plugin to version 1.2.7 or higher to patch this vulnerability. Audit user permissions and consider adding extra verification steps during the checkout process to further enhance security. You've got this! Follow these steps to keep your site safe and secure! 🛡️