Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation
2024-03-13 00:00
StiofanStrategic Overview
StatusPatched in 2.1.2
Affected PluginWeb Application Firewall – website security
Affected Version
<= 2.1.1CVSS9.8Critical
CVE
CVE-2024-2172Vulnerability Overview
The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator.
Technical Analysis
REMEDIATION: Update to version 2.1.2, or a newer patched version --- IDENTIFIER: CWE-304 (Missing Critical Step in Authentication) The product implements an authentication technique, but it skips a step that weakens the technique.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C