IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
6.5Medium

CVE-2024-5149BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness

themekraft Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC); themekraft post_form_registratio… Published: (2 years ago)

Description

The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.

Weakness (CWE): CWE-330

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
themekraft post_form_registration_form_profile_form_for_user_profiles_and_content_forms ≤ 2.8.9
themekraft Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) ≤ 2.8.9

References and patches

Recent CVEs in the same product — WordPress plugins & themes