CVE-2024-50477 — AI Deep Analysis Summary

🚨 **Essence**: Critical Authentication Bypass in Stacks Mobile App Builder. 📉 **Consequences**: Attackers can bypass login checks, leading to full account takeover and unauthorized access to sensitive data.…

🛡️ **Root Cause**: CWE-288 (Improper Authentication). 🐛 **Flaw**: The `receive_request_checkout()` function fails to properly verify user identity before granting access.…

🏢 **Vendor**: Stacks. 📦 **Product**: Stacks Mobile App Builder (WordPress Plugin). 📅 **Affected Versions**: Version **5.2.3** and all earlier versions. If you’re running this, you’re exposed!

👤 **Privileges**: Full Admin/User Access. 💾 **Data**: Attackers can impersonate **any user** based on User ID. This means they can read, modify, or delete data associated with any account on the site.…

⚡ **Threshold**: LOW. 🔓 **Auth**: None required (Unauthenticated). ⚙️ **Config**: Simple.…

💥 **Exploit**: YES. 📂 **PoC**: Publicly available on GitHub (e.g., `RandomRobbieBF/CVE-2024-50477`). 🌐 **Detection**: Nuclei templates exist. Wild exploitation is likely imminent given the ease of access.

🔍 **Check**: Scan for the plugin version. 🧪 **Test**: Use the provided PoC to attempt login via User ID manipulation. 📡 **Scan**: Run Nuclei templates targeting CVE-2024-50477.…

🩹 **Fix**: Update to a version **greater than 5.2.3**. 📢 **Official**: Patchstack and vendor have acknowledged the issue. Check for the latest release immediately. Do not ignore this update!

🚧 **Workaround**: If patching isn’t possible, **disable the plugin** immediately. 🛑 **Block**: Restrict access to WordPress admin endpoints via WAF or firewall rules.…

🔥 **Priority**: CRITICAL. 🚨 **Urgency**: HIGH. With CVSS High severity and public exploits, this is an active threat. Patch NOW or disable the plugin. Don’t wait for a breach!