VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jan 22, 2025· Updated Jun 17, 2026

CVE-2024-12857

CVE-2024-12857

Description

The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenticated attackers to authenticate as any user as long as they have configured OTP login by phone number.

Affected products

4
  • Scriptsbundle/AdForest2 versions
    cpe:2.3:a:scriptsbundle:adforest:*:*:*:*:*:wordpress:*:*+ 1 more
    • cpe:2.3:a:scriptsbundle:adforest:*:*:*:*:*:wordpress:*:*range: <5.1.9
    • (no CPE)range: 0
  • WordPress/AdForestllm-fuzzy2 versions
    <=5.1.8+ 1 more
    • (no CPE)range: <=5.1.8
    • (no CPE)

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.