Vulnerability · Published Oct 16, 2024 · Assigned by Wordfence

CVE-2024-9104UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check

Medium 5.6

In plain English

A medium-severity security flaw in Ultimate AI from Tophive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)0.3%top 72.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimate_ai_change_pass' function. This makes it possible for unauthenticated attackers to reset the password of the first user, whose account is not yet activated or the first user who activated their account, who are subscribers.

Affected products (as reported)

Vendor	Product	Versions
Tophive	Ultimate AI	0 – through 2.8.3

Weakness: CWE-703 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

In plain English

Official description

Affected products (as reported)

References