Vulnerability record/PUBLISHED/Published Jul 31, 2024 06:00:04 UTC
CVE-2024-6695
it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
Base score9.8/ 10
SeverityCriticalCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityCritical
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactHighI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedJul 31, 2024 15:06:31 UTC
PublishedJul 31, 2024 06:00:04 UTC
ReservedJul 11, 2024 15:11:55 UTC
Credits
- John Castro
- WPScan