CVE-2024-2172
The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 1.71%
- CWE
- CWE-304
- Published
- 2024-03-13
- Last modified
- 2026-04-09
Affected products
- cyberlord92 Web Application Firewall – website security
- cyberlord92 Malware Scanner
- cyberlord92 Web Application Firewall – website security
- cyberlord92 Malware Scanner
Weakness type
Related vulnerabilities
- CVE-2022-2302 — LENZE: Missing password verification in authorisation procedure
- CVE-2024-8954 — Authentication Bypass in composiohq/composio
- CVE-2022-2821 — Missing Critical Step in Authentication in namelessmc/nameless
- CVE-2024-45764 — Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. A
- CVE-2024-12048 — IDOR Vulnerability in transformeroptimus/superagi
- CVE-2019-16766 — 2FA bypass in Wagtail through new device path
- CVE-2026-55957 — Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
- CVE-2022-1065 — Multi Factor Authentication Bypass in various versions of Abacus ERP