CVE-2024-56013 HIGH

CVE-2024-56013: WordPress Wovax IDX plugin <= 1.2.2 - Account Takeover vulnerability

Vendor Wovax

Product Wovax IDX

Weakness CWE-288

Published December 16, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in wovax Wovax IDX wovax-idx allows Authentication Bypass.This issue affects Wovax IDX: from n/a through <= 1.2.2.

Explanation of Vulnerability in Simple Terms

02Summary

Wovax IDX versions 1.2.2 and earlier contain an authentication bypass vulnerability. An attacker with low-level user privileges can read, modify, or delete sensitive data and disrupt service availability. The vulnerability requires network access and valid user credentials but no additional user interaction. Organizations running affected versions should update immediately.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete sensitive data; disrupt service availability.

Potential impact on your site

04Site Impact

Unauthorized data access, modification, or deletion; potential service downtime.

Conditions required to exploit

05Prerequisites

Valid low-level user account on the system; network access.

Key dates

06Disclosure timeline

December 16, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-56013 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/288.html AskarLabs — CWE-288 write-up Authentication Bypass Using an Alternate Path or Channel

Related vulnerabilities