CVE-2024-9890

HIGH

WordPress User Toolkit <1.2.3 - Auth Bypass

Title source: llm

Description

The User Toolkit plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.3. This is due to an improper capability check in the 'switchUser' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.

Exploits (1)

nomisec WORKING POC

by RandomRobbieBF · poc

https://github.com/RandomRobbieBF/CVE-2024-9890

View Code ZIP pw:eip

References (3)

[Product] https://plugins.trac.wordpress.org/browser/user-toolkit/tags/1.2.3/src/UserSwitch.php#L51

[Product] https://plugins.trac.wordpress.org/changeset/3175190/user-toolkit#file5

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/805f18e2-9a5a-48cf-81f4-825da4bfd8ef?source=cve

Scores

CVSS v3 8.8

EPSS 0.1123

EPSS Percentile 93.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-288

Status draft

Timeline

Published Oct 26, 2024

Tracked Since Feb 18, 2026