CVE-2024-9933
The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.6. This is due to the 'watchtower_ota_token' default value is empty, and the not empty check is missing in the 'Password_Less_Access::login' function. This makes it possible for unauthenticated attackers to log in to the WatchTowerHQ client administrator user.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 1.99%
- CWE
- CWE-288
- Published
- 2024-10-26
- Last modified
- 2026-04-09
Affected products
- watchtowerhq WatchTowerHQ
- watchtowerhq WatchTowerHQ
Weakness type
Related vulnerabilities
- CVE-2026-86084 — n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
- CVE-2026-83527 — An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a...
- CVE-2026-62650 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side...
- CVE-2026-76169 — fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- CVE-2026-62916 — Microsoft Entra ID Elevation of Privilege Vulnerability
- CVE-2026-84777 — WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability
- CVE-2026-16647 — Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
- CVE-2026-81168 — CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105