Critical severity · published Dec 21, 2024
CVE-2024-11349
AdForest <= 5.1.6 - Authentication Bypass
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the sb_login_user_with_otp_fun() function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
AdForest · scriptsbundle
through 5.1.6 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11349
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11349
Product
https://themeforest.net/item/adforest-classified-wordpress-theme/19481695
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/f374b3d1-820b-473f-8d2b-c3267e6d23d9?source=cve
More from AdForest
9.8
CVE-2026-1729
AdForest <= 6.0.12 - Authentication Bypass
9.8
CVE-2025-8359
AdForest <= 6.0.9 - Authentication Bypass to Admin
9.8
CVE-2024-12857
AdForest <= 5.1.8 - Authentication Bypass
9.8
CVE-2024-11350
AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover
8.1
CVE-2025-67946
WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability