CVE-2024-9687

Summary

CVE-2024-9687 is a vulnerability affecting the WP 2FA with Telegram plugin for WordPress. This issue allows authenticated attackers, with subscriber-level permissions and above, to bypass the authentication process and log in as any existing user on the site, including administrators. The root cause is insufficient validation of user-controlled keys on the 'validate_tg' action. Successful exploitation of this vulnerability could lead to unauthorized access and potential data breaches. It is recommended that users update their plugin to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.