Authentication Bypass Using an Alternate Path or Channel (CWE-288)
The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.6. This vulnerability is due to the 'watchtower_ota_token' default value being empty, and the absence of a not-empty check in the 'Password_Less_Access::login' function. As a result, unauthenticated attackers can log in to the WatchTowerHQ client administrator user.
This vulnerability allows unauthenticated attackers to gain unauthorized access to the WatchTowerHQ client administrator user account. Given the high confidentiality, integrity, and availability impacts, attackers could potentially view, modify, or delete sensitive information, make unauthorized changes to the WordPress site, and disrupt normal operations. The ability to bypass authentication and directly access administrator-level privileges presents a severe risk to the overall security of the affected WordPress installations.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is not explicitly mentioned in the provided information. However, given that the vulnerability affects versions up to and including 3.9.6 of the WatchTowerHQ plugin, it is likely that an update beyond version 3.9.6 would include a fix for this vulnerability. Users should check for and apply the latest version of the WatchTowerHQ plugin as soon as it becomes available.
1. Update the WatchTowerHQ plugin to a version newer than 3.9.6 as soon as a patched version is available. 2. In the meantime, consider temporarily disabling the WatchTowerHQ plugin if it's not critical for operations. 3. Implement additional access controls and monitoring for the WordPress admin area. 4. Regularly audit user accounts and access logs for any suspicious activities. 5. Implement network segmentation to limit potential impact if exploitation occurs. 6. Use a Web Application Firewall (WAF) to help detect and block potential exploit attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2024-9933. See article
Feedly estimated the CVSS score as HIGH
Feedly estimated the CVSS score as MEDIUM
NVD published the first details for CVE-2024-9933
A CVSS base score of 9.8 has been assigned.
Feedly estimated the CVSS score as HIGH
CVE-2024-9933 is a critical authentication bypass vulnerability in the WatchTowerHQ plugin for WordPress, affecting versions up to 3.9.6, with a CVSS score of 9.8. Currently, there is no evidence of exploitation in the wild or public proof-of-concept exploits, but unauthenticated attackers can gain unauthorized access to the administrator account, posing severe risks to site security. Mitigations include updating to a version newer than 3.9.6, temporarily disabling the plugin, and implementing additional access controls and monitoring. See article
EPSS Score was set to: 0.04% (Percentile: 9.8%)