WordPress WooCommerce Affiliate Program Auth Bypass to Account Takeover (CVE-2024-9289)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation 2. Vulnerability Description: This vulnerability is due to the function not properly verifying user identity, allowing unauthorized attackers to log in as any user, including administrators, thereby obtaining the administrator's email. 3. CVSS Score: 9.8 (Critical) 4. Public Disclosure Date: September 30, 2024 5. Last Updated: October 1, 2024 6. Researcher: Tonn 7. Remediation Status: Fixed 8. Affected Versions: <= 8.4.1 9. Fixed Version: 8.5.0 10. Vulnerability Type: Plugin 11. Plugin Name: wp-wc-affiliate-program 12. Vulnerability ID: CVE-2024-9289 13. Public Disclosure: Yes 14. Public Disclosure Date: September 30, 2024 15. Public Disclosure Date: October 1, 2024 16. Public Disclosure Date: October 1, 2024 17. Public Disclosure Date: October 1, 2024 18. Public Disclosure Date: October 1, 2024 19. Public Disclosure Date: October 1, 2024 20. Public Disclosure Date: October 1, 2024 21. Public Disclosure Date: October 1, 2024 22. Public Disclosure Date: October 1, 2024 23. Public Disclosure Date: October 1, 2024 24. Public Disclosure Date: October 1, 2024 25. Public Disclosure Date: October 1, 2024 26. Public Disclosure Date: October 1, 2024 27. Public Disclosure Date: October 1, 2024 28. Public Disclosure Date: October 1, 2024 29. Public Disclosure Date: October 1, 2024 30. Public Disclosure Date: October 1, 2024 31. Public Disclosure Date: October 1, 2024 32. Public Disclosure Date: October 1, 2024 33. Public Disclosure Date: October 1, 2024 34. Public Disclosure Date: October 1, 2024 35. Public Disclosure Date: October 1, 2024 36. Public Disclosure Date: October 1, 2024 37. Public Disclosure Date: October 1, 2024 38. Public Disclosure Date: October 1, 2024 39. Public Disclosure Date: October 1, 2024 40. Public Disclosure Date: October 1, 2024 41. Public Disclosure Date: October 1, 2024 42. Public Disclosure Date: October 1, 2024 43. Public Disclosure Date: October 1, 2024 44. Public Disclosure Date: October 1, 2024 45. Public Disclosure Date: October 1, 2024 46. Public Disclosure Date: October 1, 2024 47. Public Disclosure Date: October 1, 2024 48. Public Disclosure Date: October 1, 2024 49. Public Disclosure Date: October 1, 2024 50. Public Disclosure Date: October 1, 2024 51. Public Disclosure Date: October 1, 2024 52. Public Disclosure Date: October 1, 2024 53. Public Disclosure Date: October 1, 2024 54. Public Disclosure Date: October 1, 2024 55. Public Disclosure Date: October 1, 2024 56. Public Disclosure Date: October 1, 2024 57. Public Disclosure Date: October 1, 2024 58. Public Disclosure Date: October 1, 2024 59. Public Disclosure Date: October 1, 2024 60. Public Disclosure Date: October 1, 2024 61. Public Disclosure Date: October 1, 2024 62. Public Disclosure Date: October 1, 2024 63. Public Disclosure Date: October 1, 2024 64. Public Disclosure Date: October 1, 2024 65. Public Disclosure Date: October 1, 2024 66. Public Disclosure Date: October 1, 2024 67. Public Disclosure Date: October 1, 2024 68. Public Disclosure Date: October 1, 2024 69. Public Disclosure Date: October 1, 2024 70. Public Disclosure Date: October 1, 2024 71. Public Disclosure Date: October 1, 2024 72. Public Disclosure Date: October 1, 2024 73. Public Disclosure Date: October 1, 2024 74. Public Disclosure Date: October 1, 2024 75. Public Disclosure Date: October 1, 2024 76. Public Disclosure Date: October 1, 2024 77. Public Disclosure Date: October 1, 2024 78. Public Disclosure Date: October 1, 2024 79. Public Disclosure Date: October 1, 2024 80. Public Disclosure Date: October 1, 2024 81. Public Disclosure Date: October 1, 2024 82. Public Disclosure Date: October 1, 2024 83. Public Disclosure Date: October 1, 2024 84. Public Disclosure Date: October 1, 2024 85. Public Disclosure Date: October 1, 2024 86. Public Disclosure Date: October 1, 2024 87. Public Disclosure Date: October 1, 2024 88. Public Disclosure Date: October 1, 2024 89. Public Disclosure Date: October 1, 2024 90. Public Disclosure Date: October 1, 2024 91. Public Disclosure Date: October 1, 2024 92. Public Disclosure Date: October 1, 2024 93. Public Disclosure Date: October 1, 2024 94. Public Disclosure Date: October 1, 2024 95. Public Disclosure Date: October 1, 2024 96. Public Disclosure Date: October 1, 2024 97. Public Disclosure Date: October 1, 2024 98. Public Disclosure Date: October 1, 2024 99. Public Disclosure Date: October 1, 2024 100. Public Disclosure Date: October 1, 2024 101. Public Disclosure Date: October 1, 2024 102. Public Disclosure Date: October 1, 2024 103. Public Disclosure Date: October 1, 2024

Goal Reached Thanks to every supporter — we hit 100%!

WordPress WooCommerce Affiliate Program Auth Bypass to Account Takeover (CVE-2024-9289)

More from this source