CVE-2024-9289

Summary

CVE-2024-9289 is a critical vulnerability affecting the WordPress & WooCommerce Affiliate Program plugin. In versions up to 8.4.1, the rtwwap_login_request_callback() function fails to verify user identities before granting access, leading to authentication bypass. Unauthenticated attackers can exploit this weakness to gain administration privileges by simply providing an administrator's email address. This issue poses a significant risk, as it enables attackers to take control of the affected WordPress site. Users are urged to upgrade to the latest plugin version, 8.4.2, to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.