The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user's identity prior to updating their password through the adforest_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
References
Configurations
History
12 Aug 2025, 16:07
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:scriptsbundle:adforest:*:*:*:*:*:wordpress:*:* | |
| First Time |
Scriptsbundle
Scriptsbundle adforest |
|
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/4ebb766a-44e9-460c-be84-356b7403e593?source=cve - Third Party Advisory | |
| References | () https://themeforest.net/item/adforest-classified-wordpress-theme/19481695 - Product |
08 Jan 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-08 09:15
Updated : 2025-08-12 16:07
NVD link : CVE-2024-11350
Mitre link : CVE-2024-11350
JSON object : View
Products Affected
scriptsbundle
- adforest
CWE
CWE-640
Weak Password Recovery Mechanism for Forgotten Password