UltimateAI <= 2.8.3 - Authentication Bypass
critical
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.8.3. This is due to insufficient verification on the user being supplied in the 'ultimate_ai_register_or_login_with_google' function. This makes it possible for unauthenticated attackers to log in as any exist...
- CVSS:
- 9.8
- Affected:
- up to 2.8.3
- Fix:
- No patched version reported
- Disclosed:
- Oct 15, 2024
CVE-2024-9105 on NVD →
UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check
medium
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimate_ai_change_pass' function. This makes it possible for unauthenticated attackers to reset the p...
- CVSS:
- 5.6
- Affected:
- up to 2.8.3
- Fix:
- No patched version reported
- Disclosed:
- Oct 15, 2024
CVE-2024-9104 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database