CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the sb_login_user_with_otp_fun() function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.
Explanation of Vulnerability in Simple Terms
AdForest versions up to 5.1.6 contain an authentication bypass vulnerability that allows unauthenticated attackers to gain full control of the application. The vulnerability stems from improper authentication validation, enabling attackers to read, modify, or delete data without credentials. All installations should update immediately.
What an attacker can do
Read, modify, or delete any data in the application without logging in.
Potential impact on your site
Complete compromise of the AdForest application and all user data; attackers can impersonate users and modify site content.
Conditions required to exploit
Network access to the AdForest installation; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
