CVE-2024-12432 WPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key
Authenticated attackers can bypass authentication to log in as site administrators due to insufficiently random key generation in the WPC Shop as a Customer plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-12432?
CVE-2024-12432 is a high-severity authentication bypass vulnerability in wpclever WPC Shop as a Customer for WooCommerce, published on 18 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generate_key' function not producing a sufficiently random value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as site administrators, granted they have triggered the ajax_login() function which generates a unique key that can be used to log in.
Weakness: CWE-330
Which versions are affected by CVE-2024-12432?
How do I fix CVE-2024-12432?
No fix has been published for CVE-2024-12432 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-12432 being exploited?
There is no known exploitation of CVE-2024-12432 in the wild and no public exploit code.
Sources
Also known as GHSA-hhr2-4cvp-f289.