CVE-2024-2172 — AI Deep Analysis Summary

🚨 **Essence**: A critical privilege escalation flaw in WordPress Plugin Malware Scanner.…

🔍 **Root Cause**: Missing functional checks in the `mo_wpns_init()` function. <br>🛑 **CWE**: CWE-304 (Improper Control of a Single Temporary Resource).…

📦 **Affected Product**: WordPress Plugin Malware Scanner (Web Application Firewall – website security). <br>👤 **Vendor**: cyberlord92 / MiniOrange. <br>📉 **Version**: 4.7.2 and earlier versions.

🕵️ **Attacker Actions**: Gain unauthorized administrative privileges. <br>💾 **Data Risk**: Full access to sensitive data, ability to modify site content, and potentially install further malware.…

🔓 **Exploitation Threshold**: LOW. <br>🌐 **Network**: Attack Vector is Network (AV:N). <br>🔑 **Auth**: Privileges Required are None (PR:N). No authentication needed to exploit.

💣 **Public Exploit**: No specific PoC code provided in the data.…

🔎 **Self-Check**: Verify if your WordPress site uses the 'Malware Scanner' plugin by MiniOrange. <br>📊 **Version Check**: Ensure the installed version is **4.7.2 or older**. If yes, you are vulnerable.

🛡️ **Official Fix**: Yes, a fix is available. <br>🔄 **Action**: Update the plugin to a version newer than 4.7.2. References point to changesets that address this issue.

🚧 **No Patch Workaround**: If you cannot update immediately, disable the plugin entirely.…

🔥 **Urgency**: CRITICAL. <br>⏱️ **Priority**: Patch immediately. With CVSS High severity, Network attack vector, and No auth required, this is a high-priority target for automated attacks.