CVE-2024-8911

Summary

CVE-2024-8911: The LatePoint plugin for WordPress, up to and including version 5.0.11, is susceptible to Arbitrary User Password Change via SQL Injection. This vulnerability stems from insufficient escaping of user-supplied parameters and an inadequately prepared SQL query. Unauthenticated attackers can exploit this flaw to change passwords of WordPress users, potentially gaining control over administrator accounts. However, this only affects installations where the "Use WordPress users as customers" setting is enabled, which is disabled by default.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.