CVE-2024-9947
Published: 23 October 2024
Summary
CVE-2024-9947 is a high-severity Improper Authentication (CWE-287) vulnerability in Properfraction Profilepress. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 33.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50231
Vulnerability details
The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for…
more
unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
A central authority can define and push correct default permissions, eliminating the common practice of leaving insecure defaults on individual hosts.
Training covers proper setting of permissions on resources, reducing incorrect default or inherited permissions after deployment.
Access control policy can specify and enforce secure default permissions for resources.
Guides setting of default permissions to the minimum required level.
Detects unauthorized successful logons resulting from improper authentication implementations.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
Security awareness training instructs users on secure authentication practices and avoiding credential compromise.
Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.