CVE-2024-50488 HIGH

CVE-2024-50488: WordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerability

Vendor Yespbs

Product Token Login

Weakness CWE-288

Published October 28, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in yespbs Token Login token-login allows Authentication Bypass.This issue affects Token Login: from n/a through <= 1.0.3.

Explanation of Vulnerability in Simple Terms

02Summary

Token Login versions 1.0.3 and earlier contain an authentication bypass vulnerability. An attacker with low-level user privileges can bypass authentication mechanisms to gain unauthorized access to sensitive functionality. This allows reading, modifying, or deleting data without proper authorization. Sites running affected versions should update immediately.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete sensitive data by bypassing authentication checks.

Potential impact on your site

04Site Impact

Unauthorized users with basic accounts can access admin functions and modify or delete site data.

Conditions required to exploit

05Prerequisites

Attacker needs a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

October 28, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-50488 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/288.html AskarLabs — CWE-288 write-up Authentication Bypass Using an Alternate Path or Channel

Related vulnerabilities