Vulnerability in Cyberlord92 Malware Scanner
CVE-2024-2172
The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator.
EPSS: 0.017 (75.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cyberlord92 Malware Scanner — versions 0
- Cyberlord92 Web Application Firewall – Website Security — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2024-2172?
- CVE-2024-2172 is a critical-severity vulnerability in Cyberlord92 Malware Scanner, classified under Missing Critical Step in Authentication. CVSS score: 9.8/10. Published 2024-03-13.
- How severe is CVE-2024-2172?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2024-2172 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.