CVE-2024-3729

Katalog CVE

CVSS 9.8 · Critical EPSS 0,82%

Kerentanan Not Failing Securely ('Failing Open') pada dynamiapps frontend admin. Skor CVSS 3.1 9.8 (Critical) menurut wordfence.com.

Deskripsi (NVD)

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the 'openssl' php extension is not loaded on the server.

Rincian

Terbit di NVD

2 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-636: Not Failing Securely ('Failing Open')
CWE-754: Improper Check for Unusual or Exceptional Conditions

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 55,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/3073379/acf-frontend-form-element#file4 patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d22c5d-5ef5-4920-a1b5-e8284394c7e8?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.18.15/main/helpers.php#L617 product