Cyber Posture

CVE-2024-13442

Critical

Published: 19 March 2025

Published
19 March 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0030 53.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

Security Summary

CVE-2024-13442 is a privilege escalation vulnerability via account takeover affecting the Service Finder Bookings plugin for WordPress in all versions up to and including 5.0. The issue stems from the plugin's failure to properly validate a user's identity before performing post-booking auto-login actions or updating profile details, such as passwords. This flaw, mapped to CWE-288 and assigned a CVSS 3.1 base score of 9.8 (Critical), enables severe authentication bypass.

Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. If an attacker's email address is known, they can log in as that arbitrary user; alternatively, they can update any user's password, including administrators, to gain unauthorized access to their accounts. Successful exploitation results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).

Advisories, including the Wordfence threat intelligence report, provide additional details on the vulnerability. The plugin is available via the ThemeForest marketplace at the referenced URL. No specific patch information is detailed in the available CVE data.

Details

CWE(s)
CWE-288

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing WordPress plugin enables unauthenticated exploitation for account takeover and password updates, directly mapping to T1190 (public-facing app exploit), T1078 (valid accounts access), and T1098 (account manipulation via password changes).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References