CVE-2024-9302: App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP
First published: Fri Oct 25 2024(Updated: )
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. This is due to the verify_otp_forgot_password() and update_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Appcheap App Builder for WordPress | <=5.3.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0eb9d676-4fa0-4bdc-af44-5d7e1dd8c6e6?source=cve
- https://plugins.trac.wordpress.org/browser/app-builder/tags/5.3.1/includes/Di/Service/Auth/ForgotPassword.php#L247
- https://plugins.trac.wordpress.org/browser/app-builder/tags/5.3.1/includes/Di/Service/Auth/ForgotPassword.php#L196
- https://plugins.trac.wordpress.org/changeset/3161215/
Frequently Asked Questions
What is the severity of CVE-2024-9302?
The severity of CVE-2024-9302 is critical due to the potential for privilege escalation through account takeover.
How do I fix CVE-2024-9302?
To fix CVE-2024-9302, update the App Builder plugin to version 5.3.8 or higher.
Which versions are affected by CVE-2024-9302?
CVE-2024-9302 affects all versions of the App Builder plugin up to and including 5.3.7.
What causes the vulnerability in CVE-2024-9302?
CVE-2024-9302 is caused by insufficient validation in the verify_otp_forgot_password() and update_password() functions.
Who is at risk from CVE-2024-9302?
Users of the App Builder plugin for WordPress who have not updated to the patched version are at risk from CVE-2024-9302.
- agent/references
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/severity
- agent/trending
- agent/epss
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/appcheap
- canonical/appcheap app builder for wordpress
- version/appcheap app builder for wordpress/5.3.7