CVE-2024-9990

The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing nonce validation in the 'crypto_connect_ajax_process::check' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/crypto/tags/2.10/includes/class-crypto_connect_ajax_register.php#L31Product
• https://plugins.trac.wordpress.org/browser/crypto/tags/2.10/includes/class-crypto_connect_ajax_register.php#L65Product
• https://plugins.trac.wordpress.org/changeset/3180126/crypto#file33
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cea39157-94aa-4982-983e-9c3e4b1af86d?source=cveThird Party Advisory

Published

Oct 29, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9984Enterprise Cloud Database from Ragic does not authenticate a…9.8
• CVE-2024-9985Enterprise Cloud Database from Ragic does not properly valid…9.8
• CVE-2024-9986A vulnerability was found in code-projects Blood Bank Manage…9.8
• CVE-2024-9987A post-authentication SQL Injection vulnerability within the…8.8
• CVE-2024-9988The Crypto plugin for WordPress is vulnerable to authenticat…9.8
• CVE-2024-9989The Crypto plugin for WordPress is vulnerable to authenticat…9.8
• CVE-2024-9991This vulnerability exists in Philips lighting devices due to…7
• CVE-2024-9993The Essential Addons for Elementor – Best Elementor Addon, T…5.4
• CVE-2024-9994The Essential Addons for Elementor – Best Elementor Addon, T…5.4
• CVE-2024-9996A maliciously crafted DWG file, when parsed in acdb25.dll th…7.8
• CVE-2024-9997A maliciously crafted DWG file when parsed in acdb25.dll thr…7.8
• CVE-2024-9998Rejected reason: The vulnerability has no impact, so it has …