Vulnerability Description
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for unauthenticated attackers to register an administrator user even if the registration form is disabled.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verificat
- https://plugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otp
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f04eab14-dd86-4145-b5e
FAQ
What is CVE-2024-9863?
CVE-2024-9863 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for t...
How severe is CVE-2024-9863?
CVE-2024-9863 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-9863?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.