CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sb_login_user_with_otp_fun' function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.
Explanation of Vulnerability in Simple Terms
AdForest versions up to 6.0.12 contain a missing authentication vulnerability that allows unauthenticated attackers to read, modify, or delete data on the site without any user interaction. The vulnerability affects the core functionality and requires only network access to exploit. Site administrators should update immediately to a version newer than 6.0.12.
What an attacker can do
Read, modify, or delete site data without logging in.
Potential impact on your site
Attackers can compromise data integrity, steal sensitive information, or disrupt site availability without credentials.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
