CE21 Suite, CVE-2024-10284

CVE, Research URL: CVE-2024-10284
Home page URL: Security reports for CE21 Suite
Application: CE21 Suite
Published on: Nov 09, 2024
Research Description: The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in the 'ce21_authentication_phrase' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Affected versions: max 2.2.1.
Status: vulnerable