CVE-2024-9862
Last modified
CVE-2024-9862 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. EPSS estimates a 0.58% chance of exploitation in the next 30 days.
Description
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Miniorange | Otp Verification With Firebase | < 3.6.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-9862?
How severe is CVE-2024-9862?
How do I fix CVE-2024-9862?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-9855A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCR…7.2
- CVE-2024-9856A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCR…4.8
- CVE-2024-9858There exists an insecure default user permission in Google C…7.8
- CVE-2024-9859Type confusion in WebAssembly in Google Chrome prior to 126.…8.8
- CVE-2024-9860The Bridge Core plugin for WordPress is vulnerable to unauth…5.4
- CVE-2024-9861The Miniorange OTP Verification with Firebase plugin for Wor…8.1
- CVE-2024-9863The Miniorange OTP Verification with Firebase plugin for Wor…9.8
- CVE-2024-9864The EventPrime – Events Calendar, Bookings and Tickets plugi…6.1
- CVE-2024-9865The EventPrime – Events Calendar, Bookings and Tickets plugi…6.1
- CVE-2024-9866The Event Tickets with Ticket Scanner plugin for WordPress i…5.4
- CVE-2024-9867The Element Pack Elementor Addons (Header Footer, Template L…5.4
- CVE-2024-9868The Element Pack Elementor Addons (Header Footer, Template L…5.4
Are you affected by CVE-2024-9862?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST