CVE-2024-50489 CRITICAL

CVE-2024-50489: WordPress Realty Workstation plugin <= 1.0.45 - Account Takeover vulnerability

Vendor Realtyworkstation
Product Realty Workstation
Weakness CWE-288
Published October 28, 2024
Last update May 12, 2026

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in realtyworkstation Realty Workstation realty-workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through <= 1.0.45.

Explanation of Vulnerability in Simple Terms

02Summary

Realty Workstation versions 1.0.45 and earlier contain an authentication bypass vulnerability. An attacker can gain unauthorized access to the application without valid credentials, potentially compromising sensitive real estate data and user information. The vulnerability requires no special network conditions or user interaction to exploit.

What an attacker can do

03Attacker Capabilities

Gain full unauthorized access to the application and read, modify, or delete sensitive data.

Potential impact on your site

04Site Impact

Attackers can access confidential real estate records, client information, and transaction data without any credentials.

Conditions required to exploit

05Prerequisites

Network access to the Realty Workstation application; no authentication or user interaction required.

Key dates

06Disclosure timeline

October 28, 2024 CVE published
May 12, 2026 Record updated

Related vulnerabilities

08Related CVE