CVE-2024-52475: 
WordPress vulnerability analysis and mitigation

CVE-2024-52475 is an Authentication Bypass vulnerability affecting the Automation Web Platform (Wawp) WordPress plugin versions before 3.0.18. The vulnerability was discovered and reported on November 19, 2024, and was assigned a CVSS v3.1 base score of 9.8 (CRITICAL) (Patchstack).

The vulnerability is classified as an Authentication Bypass Using an Alternate Path or Channel (CWE-288). It allows unauthenticated attackers to bypass authentication mechanisms in the Wawp plugin. The vulnerability received a CVSS v3.1 score of 9.8 with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability (NVD).

The vulnerability can be exploited by malicious actors to perform actions that should only be executable by higher privileged users. This could potentially allow attackers to gain administrative access to the affected WordPress website (Patchstack).

Users are advised to update to version 3.0.18 or later of the Wawp plugin to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).