Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation
Summary
| CVE | CVE-2024-2172 |
|---|---|
| State | PUBLISHED |
| Assigner | Wordfence |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-03-13 16:15:32 UTC |
| Updated | 2026-04-08 18:21:01 UTC |
| Description | The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-304 | CWE-304 CWE-304 Missing Critical Step in Authentication
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Cyberlord92 | Web Application Firewall Website Security | affected 2.1.1 semver | Not specified |
| CNA | Cyberlord92 | Malware Scanner | affected 4.7.2 semver | Not specified |
| ADP | Miniorange | Malware Scanner | affected 4.7.2 custom | Not specified |
| ADP | Miniorange | Web Application Firewall | affected 2.1.1 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| plugins.trac.wordpress.org/changeset | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/miniorange-malware-protection/tags/4.7.2/handler/logi... | af854a3a-2127-422b-91ae-364da2661108 | plugins.trac.wordpress.org | |
| wordpress.org/plugins/miniorange-malware-protection | af854a3a-2127-422b-91ae-364da2661108 | wordpress.org | |
| www.wordfence.com/threat-intel/vulnerabilities/id/6347f588-a3fd-4909-ad57-9d787... | af854a3a-2127-422b-91ae-364da2661108 | www.wordfence.com | |
| plugins.trac.wordpress.org/changeset | [email protected] | plugins.trac.wordpress.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Stiofan O'Connor (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-03-13T00:00:00.000Z | Disclosed |
Legacy QID Mappings
- 150864 WordPress Malware Scanner and Web Application Firewall Plugins: Unauthenticated Privilege Escalation Vulnerability (CVE-2024-2172)