CVE-2024-9989

CRITICAL NUCLEI

WordPress Crypto <2.15 - Auth Bypass

Title source: llm

Description

The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. This is due to a limited arbitrary method call to 'crypto_connect_ajax_process::log_in' function in the 'crypto_connect_ajax_process' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.

Exploits (1)

github WORKING POC 40 stars
by iSee857 · pythonpoc
https://github.com/iSee857/CVE-PoC/tree/main/WordPressCrypto(CVE-2024-9989).py

Nuclei Templates (1)

Crypto <= 2.15 - Authentication Bypass
CRITICALVERIFIEDby s4e-io
Shodan: http.html:"wp-content/plugins/crypto"
FOFA: body="wp-content/plugins/crypto"

References (4)

Scores

CVSS v3 9.8
EPSS 0.9261
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-288
Status published
Products (2)
odude/Crypto Tool < 2.18
odude/crypto_tool < 2.15
Published Oct 29, 2024
Tracked Since Feb 18, 2026