Vulnerability Description
The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login() function and not properly verifying the user's identity. This makes it possible for unauthenticated attackers to log in as user that has dismissed an admin notice in the past 30 days, which is often an administrator. Alternatively, a user can log in as any user with any transient that has a valid user_id as the value, though it would be more difficult to exploit this successfully.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Villatheme | Woocommerce Photo Reviews | < 1.3.14 |
Related Weaknesses (CWE)
References
- https://codecanyon.net/item/woocommerce-photo-reviews/21245349Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e2d370-a716-4d6b-8e2Third Party Advisory
FAQ
What is CVE-2024-8277?
CVE-2024-8277 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what...
How severe is CVE-2024-8277?
CVE-2024-8277 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-8277?
Check the references section above for vendor advisories and patch information. Affected products include: Villatheme Woocommerce Photo Reviews.