CVE-2024-9930: 
WordPress vulnerability analysis and mitigation

The Extensions by HocWP Team plugin for WordPress contains an authentication bypass vulnerability in versions up to and including 0.2.3.2. The vulnerability exists in the Account extension due to missing validation on the user being supplied in the 'verify_email' action (NVD).

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and has received a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The critical severity rating indicates that the vulnerability requires no privileges or user interaction to exploit, and can result in complete compromise of system confidentiality, integrity, and availability (NVD).

This vulnerability allows unauthenticated attackers to log in as any existing user on the site, including administrators. This means an attacker could gain complete administrative access to the WordPress installation without requiring any valid credentials (NVD).

Site administrators running the Extensions by HocWP Team plugin should immediately update to a version newer than 0.2.3.2 if available, or consider removing the plugin until a patch is released (NVD).