CVE-2024-2172: 
WordPress vulnerability analysis and mitigation

The Malware Scanner plugin and Web Application Firewall plugin for WordPress, both developed by miniOrange, contain a critical privilege escalation vulnerability (CVE-2024-2172) with a CVSS score of 9.8. The vulnerability affects Malware Scanner versions up to and including 4.7.2 and Web Application Firewall versions up to and including 2.1.1. The flaw was discovered by researcher Stiofan and reported through the Wordfence Bug Bounty Program (Hacker News).

The vulnerability stems from a missing capability check in the mo_wpns_init() function, which allows unauthenticated attackers to update any user's password and escalate their privileges to administrator level. The issue affects both plugins and has received a critical CVSS score of 9.8, indicating the highest level of severity (WPScan).

Once an attacker gains administrative access, they can manipulate all aspects of the targeted WordPress site, including uploading potentially malicious plugin and theme files containing backdoors, modifying posts and pages, redirecting site users to malicious sites, and injecting spam content (Hacker News).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. A proof of concept exists that demonstrates how attackers can reset any account's password, allowing them to take over sites by resetting an administrator's password (WPScan).

In response to the vulnerability, miniOrange permanently closed both affected plugins on March 7, 2024, with no patch available. Website administrators are urged to immediately remove these plugins from their WordPress installations. Wordfence has implemented a firewall rule to protect against exploits, with Premium users receiving protection on March 4, 2024, and free users scheduled for protection on April 3, 2024 (GB Hackers).

The discovery earned the researcher Stiofan a bounty of $1,250.00 through the Wordfence Bug Bounty Program. The security community has emphasized the critical nature of this vulnerability, with multiple security firms and researchers urging WordPress administrators to take immediate action by removing the affected plugins (GB Hackers).