WP 2FA with Telegram <= 3.0 - Two-Factor Authentication Bypass
Strategic Overview
- Status
- Patched in 3.1
- Affected Plugin
- AuthPress
- Affected Version
<= 3.0- CVSS
- 6.5Medium
- Weakness type
- CWE-784 · Reliance on Cookies without Validation and Integrity Checking in a Security Decision
- CVE
CVE-2024-9820
At a glance
CVE-2024-9820 is a medium-severity Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in the AuthPress WordPress plugin, affecting versions <= 3.0. It carries a CVSS score of 6.5 (reachable over the network; low attack complexity; high integrity impact). The issue is fixed in version 3.1; sites on affected versions should update now. Disclosed October 2024, reported by István Márton.
Vulnerability Overview
The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on integrity.
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
Remediation
Update to version 3.1, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: AuthPress 3.1 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Related records
Other vulnerabilities in AuthPress
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C