CVE-2024-5204

The Swiss Toolkit For WP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.7. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for authenticated attackers with contributor-level and above permissions to log in as any existing user on the site, such as an administrator.

• CWE-288

• https://plugins.trac.wordpress.org/browser/swiss-toolkit-for-wp/trunk/includes/plugins/class-boomdevs-swiss-toolkit-generate-login-url.php?rev=3077000#L50
• https://plugins.trac.wordpress.org/changeset/3091913/swiss-toolkit-for-wp
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a8526106-847a-420f-9275-f759a8dd4dfb?source=cve
• https://plugins.trac.wordpress.org/browser/swiss-toolkit-for-wp/trunk/includes/plugins/class-boomdevs-swiss-toolkit-generate-login-url.php?rev=3077000#L50
• https://plugins.trac.wordpress.org/changeset/3091913/swiss-toolkit-for-wp
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a8526106-847a-420f-9275-f759a8dd4dfb?source=cve

Published

May 29, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5203Rejected reason: After careful review of CVE-2024-5203, it h…
• CVE-2024-52030Netgear R7000P v1.3.3.154 was discovered to contain a stack …5.7
• CVE-2024-52032Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fa…4.3
• CVE-2024-52033Exposure of sensitive system information to an unauthorized …5.3
• CVE-2024-52034An OS Command Injection vulnerability exists within myPRO Ma…10
• CVE-2024-52035An integer overflow vulnerability exists in the OLE Document…7.8
• CVE-2024-52043Generation of Error Message Containing Sensitive Information…5.3
• CVE-2024-52046The ObjectSerializationDecoder in Apache MINA uses Java’s na…9.8
• CVE-2024-52047A widget local file inclusion vulnerability in Trend Micro A…8.8
• CVE-2024-52048A LogServer link following vulnerability in Trend Micro Apex…7.8
• CVE-2024-52049A LogServer link following vulnerability in Trend Micro Apex…7.8
• CVE-2024-5205The Videojs HTML5 Player plugin for WordPress is vulnerable …6.4