CVE-2024-9822
CRITICALPedalo Connector <= 2.0.5 - Unauthenticated Authentication Bypass via login_admin_user Function
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-9822. PoCs published by RandomRobbieBF.
AI-analyzed exploit summary This PoC demonstrates an authentication bypass vulnerability in the Pedalo Connector WordPress plugin (versions <= 2.0.5). The exploit leverages insufficient restrictions on the 'login_admin_user' function, allowing unauthenticated attackers to log in as the first user (typically the administrator).
Description
The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'login_admin_user' function. This makes it possible for unauthenticated attackers to log to the first user, who is usually the administrator, or if it does not exist, then to the first administrator.
Exploits (1)
This PoC demonstrates an authentication bypass vulnerability in the Pedalo Connector WordPress plugin (versions <= 2.0.5). The exploit leverages insufficient restrictions on the 'login_admin_user' function, allowing unauthenticated attackers to log in as the first user (typically the administrator).
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H