CVE-2024-8277 PoC — WooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation

Source

https://github.com/realbotnet/CVE-2024-8277

Associated Vulnerability

Title:WooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation (CVE-2024-8277)
Description:The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login() function and not properly verifying the user's identity. This makes it possible for unauthenticated attackers to log in as user that has dismissed an admin notice in the past 30 days, which is often an administrator. Alternatively, a user can log in as any user with any transient that has a valid user_id as the value, though it would be more difficult to exploit this successfully.

Description

CVE-2024-8277 - 0Day Auto Exploit Authentication Bypass in WooCommerce Photo Reviews Plugin

Readme

<h1 align="left">CVE-2024-8277 - Authentication Bypass in WooCommerce Photo Reviews by <a href="https://t.me/bl4ckhatx" target="_blank">
  @bl4ckhatx
  </a></h1>

### 

<h3 align="left">This is just a teaser. The full exploit’s for sale. Want to compromise thousands of sites? Hit me up. <a href="https://t.me/bl4ckhatx" target="_blank">
  @bl4ckhatx
  </a></h3>

### 

<div align="center">
  <img   src="exploit.jpg"  />
</div>

### 

<h2 align="left">🎯 CVE-2024-8277: WooCommerce Exploit - Contact: <a href="https://t.me/bl4ckhatx" target="_blank">
  @bl4ckhatx
  </a></h2>

### 

<p align="left">A critical authentication bypass vulnerability in WooCommerce Photo Reviews Premium, affecting all versions ≤ 1.3.13.2. Exploit the login function to impersonate administrators, gaining full control of WordPress sites. Fast, silent, and efficient.</p>

### 

<h2 align="left">Overview - CVE-2024-8277</h2>

### 

<p align="left">This repository contains an exploit for CVE-2024-8277, which affects the WooCommerce Photo Reviews Premium plugin for WordPress. The exploit takes advantage of an authentication bypass due to improper validation in the login function. Attackers can impersonate any user, including administrators, who dismissed an admin notice in the last 30 days. This makes it easy for unauthorized access to be gained on vulnerable websites.</p>

### 

<h3 align="left">For more details or to secure a customized exploit kit, reach out on Telegram: <a href="https://t.me/bl4ckhatx" target="_blank">
  @bl4ckhatx
  </a></h3>

### 

<div align="left">
  <a href="https://t.me/bl4ckhatx" target="_blank">
    <img src="https://raw.githubusercontent.com/maurodesouza/profile-readme-generator/master/src/assets/icons/social/telegram/default.svg" width="52" height="40" alt="telegram logo"  />
  </a>
</div>

###

File Snapshot


 [4.0K]  /data/pocs/e726b17c619cb89bbd0a7e75c3f472a87f3d657c
├── [ 21K]  exploit.jpg
└── [1.8K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!