CVE-2024-12857: critical vulnerability in scriptsbundle AdForest
AdForest <= 5.1.8 - Authentication Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.8%
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenticated attackers to authenticate as any user as long as they have configured OTP login by phone number.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
scriptsbundle · AdForestRelated CVEs — scriptsbundle AdForest
In the same product, most dangerous first.
CVE-2024-11349CRITICALAdForest <= 5.1.6 - Authentication BypassEPSS 1.2%CVE-2024-11350CRITICALAdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account TakeoverEPSS 0.7%CVE-2026-1729CRITICALAdForest <= 6.0.12 - Authentication BypassEPSS 0.6%CVE-2025-67946HIGHWordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2025-8359CRITICALAdForest <= 6.0.9 - Authentication Bypass to AdminEPSS 0.5%CVE-2024-12855MEDIUMAdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment DeletionEPSS 0.3%