CVE-2024-5149: 
WordPress vulnerability analysis and mitigation

The BuddyForms plugin for WordPress contains an Email Verification Bypass vulnerability (CVE-2024-5149) affecting all versions up to and including 2.8.9. The vulnerability stems from the use of an insufficiently random activation code in the email verification process (NVD).

The vulnerability is classified with CWE-330 (Use of Insufficiently Random Values) and has received a CVSS v3.1 base score of 5.3 (Medium) from NIST and 6.5 (Medium) from Wordfence. The vulnerability allows remote exploitation with no privileges or user interaction required, as indicated by the CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability enables unauthenticated attackers to bypass the email verification process in the BuddyForms plugin. This could potentially allow malicious actors to create verified accounts without having access to the specified email addresses (NVD).

The vulnerability can be exploited remotely by unauthenticated attackers. The attack complexity is considered low, requiring no special privileges or user interaction to execute (NVD).

Users should upgrade to a version newer than 2.8.9 when available. As this is a recently disclosed vulnerability, the vendor may still be working on a patch (NVD).