CVE-2024-9862criticalCWE-639

CVE-2024-9862: fallo crítico en cyberlord92 Miniorange OTP Verification with…

Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Miniorange OTP Verification with Firebase

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.6%
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
cyberlord92 · Miniorange OTP Verification with Firebase
CVEs relacionadas — cyberlord92 Miniorange OTP Verification with…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-9861HIGHMiniorange OTP Verification with Firebase <= 3.6.0 - Authentication BypassEPSS 0.6%CVE-2024-9863CRITICALMiniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role ValueEPSS 0.6%CVE-2025-7665HIGHMiniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege EscalationEPSS 0.4%