CVE-2024-49328
Authentication Bypass Using an Alternate Path or Channel (CWE-288)
Published: Oct 20, 2024 / Updated: 30d ago

010

CVSS 9.8EPSS 0.04%Critical

CVE info copied to clipboard

Summary

Authentication Bypass Using an Alternate Path or Channel vulnerability in Vivek Tamrakar WP REST API FNS allows Authentication Bypass. This issue affects WP REST API FNS: from n/a through 1.0.0.

Impact

This vulnerability has a CVSS v3.1 base score of 9.8, indicating a critical severity. The impact is high across all three main areas: confidentiality, integrity, and availability. Attackers can potentially bypass authentication mechanisms, gaining unauthorized access to the system. This could lead to unauthorized data access, modification of critical information, and potential disruption of system availability.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the current information, there is no specific mention of a patch. The vulnerability affects WP REST API FNS versions through 1.0.0, suggesting that versions up to and including 1.0.0 are vulnerable.

Mitigation

Given the critical nature of this vulnerability, immediate action is recommended: 1. If possible, disable or remove the WP REST API FNS plugin until a patch is available. 2. Implement strong access controls and monitor for any suspicious activities related to authentication. 3. Consider implementing additional security layers such as Web Application Firewalls (WAF) to help detect and prevent potential exploitation attempts. 4. Regularly check for updates from the plugin developer and apply any security patches as soon as they become available. 5. Conduct a thorough security audit of your WordPress installation and other plugins to identify and address any additional vulnerabilities.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H