CVE-2024-13182
Published: 13 February 2025
Description
The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator.
Security Summary
CVE-2024-13182 is an authentication bypass vulnerability affecting the WP Directorybox Manager plugin for WordPress in all versions up to and including 2.5. The flaw arises from incorrect authentication logic in the 'wp_dp_parse_request' function, which allows unauthorized access without proper validation. Published on 2025-02-13, it is classified under CWE-288 (Authentication Improperly Specified) with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no privileges or user interaction required. Successful exploitation enables attackers to log in as any existing user on the site, such as an administrator, potentially granting full control over the WordPress installation.
Advisories, including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9e5e5d-a7fc-4159-a2ae-610bee76f818?source=cve, provide further details on the issue. A referenced code location at line 43 in wp-content/plugins/wp-directorybox-manager/elements/login/cs-social-login/cs-social-login.php highlights the authentication flaw in the social login component.
Details
- CWE(s)