CVE-2024-13688 Admin and Site Enhancements (ASE) < 7.6.10 - Password Protection Bypass
Attackers can bypass password protection in the Admin and Site Enhancements WordPress plugin using a hardcoded credential.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-13688?
CVE-2024-13688 is a medium-severity vulnerability in Unknown Admin and Site Enhancements (ASE), published on 28 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass the protection offered via a crafted request
Weakness: CWE-798
Which versions are affected by CVE-2024-13688?
It affects 1 product.
Products include Wpase Admin and Site Enhancements.
How do I fix CVE-2024-13688?
No fix has been published for CVE-2024-13688 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-13688 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-13688 exists.
Other vulnerabilities in Unknown Admin and Site Enhancements (ASE)
Sources
Also known as GHSA-h7hv-3j2q-qw9g.