CVE-2024-5770: webfactoryltd wp force ssl

csirt@kutim:~/threat-intel/cve/CVE-2024-5770

CVSS 4.3 · Medium EPSS 0,35%

Kerentanan Missing Authorization pada webfactoryltd wp force ssl. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permissions and above, to update the plugin settings.

Rincian

Terbit di NVD: 8 Juni 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 0,35% peluang dieksploitasi; lebih tinggi dari 26,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
webfactoryltd	wp force ssl	Semua versi sebelum 1.67

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://plugins.trac.wordpress.org/changeset/3099110/ patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/c2081e4a-c6b7-4730-be59-bc728b90ecaa?source=cve advisory pihak ketiga
https://plugins.trac.wordpress.org/browser/wp-force-ssl/tags/1.66/wp-force-ssl.php#L953 product
https://swisskyrepo.github.io/PayloadsAllTheThings/CRLF%20Injection/ not applicable

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.