CVE-2024-13375

CRITICAL EXPLOITED

Adifier System <3.1.7 - Privilege Escalation

Title source: llm

Exploitation Summary

CVE-2024-13375 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The Adifier System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.1.7. This is due to the plugin not properly validating a user's identity prior to updating their details like password through the adifier_recover() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

References (2)

Core 2

Core References

Various Sources

https://themeforest.net/item/adifier-classified-ads-wordpress-theme/21633950

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/fbf2aeed-0f18-4ef6-aff8-9e8c4531d789?source=cve

Scores

CVSS v3 9.8

EPSS 0.1378

EPSS Percentile 94.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

VulnCheck KEV 2025-01-18

CWE

CWE-620

Status published

Products (1)

spoonthemes/Adifier System < 3.1.7

Published Jan 18, 2025

Tracked Since Feb 18, 2026