| ID |
CVE-2024-9687
|
| Summary |
The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator. |
| References |
|
| Vulnerable Configurations |
|
| CVSS |
| Base: | None |
| Impact: | |
| Exploitability: | |
|
| CWE |
CWE-639 |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
|
|
|
|
| Impact |
| Confidentiality | Integrity | Availability |
|
|
|
|
| Last major update |
17-10-2024 - 21:11 |
| Published |
15-10-2024 - 02:15 |
| Last modified |
17-10-2024 - 21:11 |
