VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Dec 21, 2024· Updated Jun 17, 2026

CVE-2024-11349

CVE-2024-11349

Description

The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the sb_login_user_with_otp_fun() function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.

Affected products

3
  • WordPress/AdForestllm-fuzzy
    Range: <=5.1.6
  • Scriptsbundle/AdForest2 versions
    cpe:2.3:a:scriptsbundle:adforest:*:*:*:*:*:wordpress:*:*+ 1 more
    • cpe:2.3:a:scriptsbundle:adforest:*:*:*:*:*:wordpress:*:*range: <5.1.7
    • (no CPE)range: 0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.