QID 150864

Date Published: 2024-04-11

QID 150864: WordPress Malware Scanner and Web Application Firewall Plugins: Unauthenticated Privilege Escalation Vulnerability (CVE-2024-2172)

Miniorange offers essential WordPress security with two powerful plugins: the WordPress Malware Scanner and the Web Application Firewall. Scan for malware across your WordPress files and plugins, while the firewall defends against cyber attacks.

The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function. This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator.

Affected Versions:
WordPress Malware Scanner plugin before 4.7.3
WordPress Web Application Firewall plugin before 2.1.2

QID Detection Logic:
This QID sends a HTTP GET request and checks for vulnerable version of WordPress plugin running on the target application.

Successful exploitation of this vulnerability could allow unauthenticated attackers to takeover sites by resetting one of its administrators password.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as Critical - 10 severity.
    • Solution
    Customers are advised to upgrade to Malware Scanner 4.7.3 , Web Application Firewall 2.1.2 or later version to remediate this vulnerability.
    Vendor References

    CVEs related to QID 150864

    CVE-2024-2172 |
    Software Advisories
    Advisory ID Software Component Link
    Malware Scanner URL Logo wordpress.org/plugins/miniorange-malware-protection/#developers
    Web Application Firewall – website security URL Logo wordpress.org/plugins/web-application-firewall/#developers
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].