WordPress WooCommerce Affiliate Program Auth Bypass to Account Takeover (CVE-2024-9289)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation 2. Vulnerability Description: This vulnerability arises because the function does not properly validate user authentication, allowing unauthorized attackers to log in as any user, including administrators, thereby gaining access to the administrator's email address. 3. CVSS Score: 9.8 (Critical) 4. Public Release Date: September 30, 2024 5. Last Updated Date: October 1, 2024 6. Researcher: Tonn 7. Fix Status: Fixed 8. Affected Versions: <= 8.4.1 9. Fixed Version: 8.5.0 10. Vulnerability Type: Plugin 11. Plugin Name: wp-wc-affiliate-program 12. Vulnerability ID: CVE-2024-9289 13. Vulnerability Disclosure: Publicly disclosed 14. Disclosure Date: September 30, 2024 15. Disclosure Date: October 1, 2024 16. Disclosure Date: October 1, 2024 17. Disclosure Date: October 1, 2024 18. Disclosure Date: October 1, 2024 19. Disclosure Date: October 1, 2024 20. Disclosure Date: October 1, 2024 21. Disclosure Date: October 1, 2024 22. Disclosure Date: October 1, 2024 23. Disclosure Date: October 1, 2024 24. Disclosure Date: October 1, 2024 25. Disclosure Date: October 1, 2024 26. Disclosure Date: October 1, 2024 27. Disclosure Date: October 1, 2024 28. Disclosure Date: October 1, 2024 29. Disclosure Date: October 1, 2024 30. Disclosure Date: October 1, 2024 31. Disclosure Date: October 1, 2024 32. Disclosure Date: October 1, 2024 33. Disclosure Date: October 1, 2024 34. Disclosure Date: October 1, 2024 35. Disclosure Date: October 1, 2024 36. Disclosure Date: October 1, 2024 37. Disclosure Date: October 1, 2024 38. Disclosure Date: October 1, 2024 39. Disclosure Date: October 1, 2024 40. Disclosure Date: October 1, 2024 41. Disclosure Date: October 1, 2024 42. Disclosure Date: October 1, 2024 43. Disclosure Date: October 1, 2024 44. Disclosure Date: October 1, 2024 45. Disclosure Date: October 1, 2024 46. Disclosure Date: October 1, 2024 47. Disclosure Date: October 1, 2024 48. Disclosure Date: October 1, 2024 49. Disclosure Date: October 1, 2024 50. Disclosure Date: October 1, 2024 51. Disclosure Date: October 1, 2024 52. Disclosure Date: October 1, 2024 53. Disclosure Date: October 1, 2024 54. Disclosure Date: October 1, 2024 55. Disclosure Date: October 1, 2024 56. Disclosure Date: October 1, 2024 57. Disclosure Date: October 1, 2024 58. Disclosure Date: October 1, 2024 59. Disclosure Date: October 1, 2024 60. Disclosure Date: October 1, 2024 61. Disclosure Date: October 1, 2024 62. Disclosure Date: October 1, 2024 63. Disclosure Date: October 1, 2024 64. Disclosure Date: October 1, 2024 65. Disclosure Date: October 1, 2024 66. Disclosure Date: October 1, 2024 67. Disclosure Date: October 1, 2024 68. Disclosure Date: October 1, 2024 69. Disclosure Date: October 1, 2024 70. Disclosure Date: October 1, 2024 71. Disclosure Date: October 1, 2024 72. Disclosure Date: October 1, 2024 73. Disclosure Date: October 1, 2024 74. Disclosure Date: October 1, 2024 75. Disclosure Date: October 1, 2024 76. Disclosure Date: October 1, 2024 77. Disclosure Date: October 1, 2024 78. Disclosure Date: October 1, 2024 79. Disclosure Date: October 1, 2024 80. Disclosure Date: October 1, 2024 81. Disclosure Date: October 1, 2024 82. Disclosure Date: October 1, 2024 83. Disclosure Date: October 1, 2024 84. Disclosure Date: October 1, 2024 85. Disclosure Date: October 1, 2024 86. Disclosure Date: October 1, 2024 87. Disclosure Date: October 1, 2024 88. Disclosure Date: October 1, 2024 89. Disclosure Date: October 1, 2024 90. Disclosure Date: October 1, 2024 91. Disclosure Date: October 1, 2024 92. Disclosure Date: October 1, 2024 93. Disclosure Date: October 1, 2024 94. Disclosure Date: October 1, 2024 95. Disclosure Date: October 1, 2024 96. Disclosure Date: October 1, 2024 97. Disclosure Date: October 1, 2024 98. Disclosure Date: October 1, 2024 99. Disclosure Date: October 1, 2024 100. Disclosure Date: October 1, 2024 101. Disclosure Date: October 1, 2024 102. Disclosure Date: October 1, 2024 103. Disclosure Date: October 1, 2024

Goal Reached Thanks to every supporter — we hit 100%!

WordPress WooCommerce Affiliate Program Auth Bypass to Account Takeover (CVE-2024-9289)

More from this source