VULNERABILITY INTELLIGENCE
CVE-2024-9931
CVSS score9.8 CRITICAL
EPSS probability0.56%
CISA KEVNot currently listed
Published2024-10-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on the token being supplied during the autologin through the plugin. This makes it possible for unauthenticated attackers to log in to the first administrator user.
Weakness classification
- security@wordfence.com: CWE-288