Descrição
The Build App Online plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.21. This is due to missing authentication checking in the ‘set_user_cart’ function with the ‘user_id’ header value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
Software
Não informado
Tipo Software
Plugin
CVE
CVE-2024-3658
Tags
Nâo informado
Data de publicação
18/05/2024
Última atualização
21/05/2024
Pontuação em CVSS 3.0
9.8
Crítico