{"api_version":"1","generated_at":"2026-04-23T18:35:35+00:00","cve":"CVE-2024-5149","urls":{"html":"https://cve.report/CVE-2024-5149","api":"https://cve.report/api/cve/CVE-2024-5149.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-5149","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-5149"},"summary":{"title":"BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness","description":"The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.","state":"PUBLISHED","assigner":"Wordfence","published_at":"2024-06-05 05:15:50","updated_at":"2026-04-08 19:21:51"},"problem_types":["CWE-330","CWE-330 CWE-330 Use of Insufficiently Random Values"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"security@wordfence.com","type":"Secondary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","data":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.8.9/includes/wp-insert-user.php#L334","name":"https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.8.9/includes/wp-insert-user.php#L334","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c8d361-698b-4abd-bcdd-0361d3fd10c5?source=cve","name":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c8d361-698b-4abd-bcdd-0361d3fd10c5?source=cve","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/changeset/3101478/buddyforms/trunk/includes/wp-insert-user.php","name":"https://plugins.trac.wordpress.org/changeset/3101478/buddyforms/trunk/includes/wp-insert-user.php","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5149","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5149","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"themekraft","product":"Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)","version":"affected 2.8.9 semver","platforms":[]},{"source":"ADP","vendor":"themekraft","product":"post_form_registration_form_profile_form_for_user_profiles_and_content_forms","version":"affected 2.8.9 semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2024-05-20T00:00:00.000Z","lang":"en","value":"Discovered"},{"source":"CNA","time":"2024-06-04T00:00:00.000Z","lang":"en","value":"Disclosed"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"István Márton","lang":"en"}],"nvd_cpes":[{"cve_year":"2024","cve_id":"5149","vulnerable":"1","versionEndIncluding":"2.8.9","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"themekraft","cpe5":"buddyforms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2024","cve_id":"5149","cve":"CVE-2024-5149","epss":"0.003590000","percentile":"0.581460000","score_date":"2026-04-12","updated_at":"2026-04-13 00:12:16"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"affected":[{"cpes":["cpe:2.3:a:themekraft:post_form_registration_form_profile_form_for_user_profiles_and_content_forms:*:*:*:*:*:wordpress:*:*"],"defaultStatus":"unaffected","product":"post_form_registration_form_profile_form_for_user_profiles_and_content_forms","vendor":"themekraft","versions":[{"lessThanOrEqual":"2.8.9","status":"affected","version":"0","versionType":"semver"}]}],"metrics":[{"other":{"content":{"id":"CVE-2024-5149","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-06-05T13:15:32.320158Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-07-15T17:07:44.692Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2024-08-01T21:03:11.016Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c8d361-698b-4abd-bcdd-0361d3fd10c5?source=cve"},{"tags":["x_transferred"],"url":"https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.8.9/includes/wp-insert-user.php#L334"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)","vendor":"themekraft","versions":[{"lessThanOrEqual":"2.8.9","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"István Márton"}],"descriptions":[{"lang":"en","value":"The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification."}],"metrics":[{"cvssV3_1":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-330","description":"CWE-330 Use of Insufficiently Random Values","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-08T17:13:20.043Z","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence"},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c8d361-698b-4abd-bcdd-0361d3fd10c5?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.8.9/includes/wp-insert-user.php#L334"},{"url":"https://plugins.trac.wordpress.org/changeset/3101478/buddyforms/trunk/includes/wp-insert-user.php"}],"timeline":[{"lang":"en","time":"2024-05-20T00:00:00.000Z","value":"Discovered"},{"lang":"en","time":"2024-06-04T00:00:00.000Z","value":"Disclosed"}],"title":"BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness"}},"cveMetadata":{"assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","assignerShortName":"Wordfence","cveId":"CVE-2024-5149","datePublished":"2024-06-05T04:32:25.171Z","dateReserved":"2024-05-20T18:19:39.520Z","dateUpdated":"2026-04-08T17:13:20.043Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-06-05 05:15:50","lastModifiedDate":"2026-04-08 19:21:51","problem_types":["CWE-330","CWE-330 CWE-330 Use of Insufficiently Random Values"],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:themekraft:buddyforms:*:*:*:*:*:wordpress:*:*","versionEndIncluding":"2.8.9","matchCriteriaId":"FA366645-68E9-4808-821F-E0A5F8582939"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"5149","Ordinal":"1","Title":"BuddyForms <= 2.8.9 - Email Verification Bypass due to Insuffici","CVE":"CVE-2024-5149","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"5149","Ordinal":"1","NoteData":"The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.","Type":"Description","Title":"BuddyForms <= 2.8.9 - Email Verification Bypass due to Insuffici"}]}}}