CVE-2024-9104 Information

Description

The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to and including 2.8.3. This is due to the improper empty value check and a missing default activated value check in the ‘ultimate_ai_change_pass’ function. This makes it possible for unauthenticated attackers to reset the password of the first user whose account is not yet activated or the first user who activated their account who are subscribers.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Reference

https://www.wordfence.com/threat-intel/vulnerabilities/id/3faf976d-0763-4e47-9bc3-18c791ec4487?source=cve https://codecanyon.net/item/ultimateai-ai-enhanced-wordpress-plugin-with-saas-for-content-code-chat-and-image-generation/51201953

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

LOW

Base Severity

5.6