Published On: Jan 27, 2025 11:57
Advisory No: TZCERT-SA-25-0054
Source: Wordfence
Software Affected: bootstrap-ultimate, adforest
WordPress is vulnerable to critical vulnerabilities. Exploitation of these vulnerabilities may allow an unauthenticated attacker to execute arbitrary code.
WordPress plugins bootstrap-ultimate, and adforest are affected by the vulnerabilities tracked as CVE-2024-13545, and CVE-2024-12857 with a CVSS score of 9.8 each. The plugins are vulnerable due to the flaw leading to Local File Inclusion; and improper verification of the user's identity before logging them in as that user. The vulnerabilities allow unauthenticated attackers to achieve code execution, and to authenticate as any user as long as they have configured OTP login by phone number.
Successful exploitation of these vulnerabilities may allow the attackers to take control of the affected system.
WordPress has released security patches for these vulnerabilities. Users and administrators are encouraged to apply necessary updates.
A digest of Tanzania Computer Emergency Response Team coverage of cyber-security news across the globe.
