CRITICAL🇵🇱 Wersja polska

CVE-2024-11349

CVSS 9.8v3.1pub. 2024-12-21upd. 2025-08-12

The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the sb_login_user_with_otp_fun() function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Scriptsbundle Adforest

    APP
    Scriptsbundle
    < 5.1.7
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2024-12857CRITICAL9.8PL ✓ten sam produkt

AdForest WordPress Theme — Authentication Bypass przez OTP (do v5.1.8)

CVE-2024-11350CRITICAL9.8PL ✓ten sam produkt

AdForest dla WordPress — przejęcie konta i privilege escalation bez uwierzytelnienia

CVE-2024-12855MEDIUM4.3ten sam produkt

The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit...

CVE-2025-0169MEDIUM6.4ten sam vendor

The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in v...

CVE-2019-15870MEDIUM5.4ten sam vendor

The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.